CI_Security: URL-decode until possible

bcit-ci · Feb 10, 2014 · 29e1264 · 29e1264
1 parent f7f9dca
commit 29e1264
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/system/core/Security.php b/system/core/Security.php
@@ -359,7 +359,11 @@ public function xss_clean($str, $is_image = FALSE)
 		 *
 		 * Note: Use rawurldecode() so it does not remove plus signs
 		 */
-		$str = rawurldecode($str);
+		do
+		{
+			$str = rawurldecode($str);
+		}
+		while (preg_match('/%[0-9a-f]{2,}/i', $str));
 
 		/*
 		 * Convert character entities to ASCII