html: Drop xml processing instructions from email

osTicket · Feb 28, 2014 · d162135 · d162135
1 parent 12da45f
commit d162135
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/include/class.format.php b/include/class.format.php
@@ -202,8 +202,9 @@ function safe_html($html) {
             array(':<(head|style|script).+</\1>:is',   # <head> and <style> sections
                   ':<!\[[^]<]+\]>:',            # <![if !mso]> and friends
                   ':<!DOCTYPE[^>]+>:',          # <!DOCTYPE ... >
+                  ':<\?[^>]+>:',                # <?xml version="1.0" ... >
             ),
-            array('', '', ''),
+            array('', '', '', ''),
             $html);
         $config = array(
             'safe' => 1, //Exclude applet, embed, iframe, object and script tags.