Re: [Bug #2051] Query string including 'action=' not handled properly

[Gunnar Hjalmarsson]

Gunnar:

I made MHonArc accept the occurrence of 'action=' in a query string by editing line 333 in mhtxthtml.pl:

$$data =~ s/(\s$UAttr\s*=\s*)([^\s'">][^\s>]+)
-----------------^^

Earl:

This is a known limitation.  The change you made allows
for scripting content to make it through the filtering,
so it will not be used.  Example:

<a href="/"onmouseover="javascript:alert('onmouseover');">Server Home</a>

Okay... Since I couldn't re-open the bug, let me make a new try here. How about:

$$data =~ s/([^\?&;]$UAttr\s*=\s*)([^\s'">][^\s>]+)
-----------------^^^^^^^

/ Gunnar


---------------------------------------------------------------------
To sign-off this list, send email to [EMAIL PROTECTED] with the
message text UNSUBSCRIBE MHONARC-DEV