diff --git a/application/core/LSYii_Validators.php b/application/core/LSYii_Validators.php index 76bb188a76f..437ee119bbe 100644 --- a/application/core/LSYii_Validators.php +++ b/application/core/LSYii_Validators.php @@ -46,10 +46,11 @@ protected function validateAttribute($object,$attribute) $object->$attribute=str_replace('javascript:','',html_entity_decode($object->$attribute, ENT_QUOTES, "UTF-8")); } } + // Note that URL checking only checks basic URL properties. As a URL can contain EM expression there needs to be a lot of freedom. if($this->isUrl) { if ($object->$attribute== 'http://' || $object->$attribute=='https://') {$object->$attribute="";} - $object->$attribute=str_replace(array('"',"'",' ','<','>'),'',html_entity_decode($object->$attribute, ENT_QUOTES, "UTF-8")); // 140219 : Why not urlencode ? + $object->$attribute=html_entity_decode($object->$attribute, ENT_QUOTES, "UTF-8"); } if($this->isLanguage) {