From 55ba242f4d1413f8554cb84c2efc1e9b99aecd50 Mon Sep 17 00:00:00 2001
From: Kentaro Ohkouchi <nanasess@fsm.ne.jp>
Date: Wed, 12 May 2021 15:00:58 +0900
Subject: [PATCH] =?UTF-8?q?`<svg.*on.*=3F>|<img.*on.*=3F>`=20=E3=81=AF?=
 =?UTF-8?q?=E3=83=9E=E3=83=83=E3=83=81=E3=81=99=E3=82=8B=E7=AF=84=E5=9B=B2?=
 =?UTF-8?q?=E3=81=8C=E5=BA=83=E3=81=99=E3=81=8E=E3=82=8B=E3=81=9F=E3=82=81?=
 =?UTF-8?q?=20onload|onerror=20=E3=81=AB=E9=99=90=E5=AE=9A=E3=81=99?=
 =?UTF-8?q?=E3=82=8B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 data/smarty_extends/modifier.script_escape.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/data/smarty_extends/modifier.script_escape.php b/data/smarty_extends/modifier.script_escape.php
index dd9a1e7312..a84374bdde 100644
--- a/data/smarty_extends/modifier.script_escape.php
+++ b/data/smarty_extends/modifier.script_escape.php
@@ -9,7 +9,7 @@ function smarty_modifier_script_escape($value)
 {
     if (is_array($value)) return $value;
 
-    $pattern = "/<script.*?>|<\/script>|javascript:|<svg.*on.*?>|<img.*on.*?>|<body.*onload.*?>|<iframe.*?>|<object.*?>|<embed.*?>|<.*onmouse.*?>/i";
+    $pattern = "/<script.*?>|<\/script>|javascript:|<svg.*(onload|onerror).*?>|<img.*(onload|onerror).*?>|<body.*onload.*?>|<iframe.*?>|<object.*?>|<embed.*?>|<.*onmouse.*?>/i";
     $convert = '#script tag escaped#';
 
     if (preg_match_all($pattern, $value, $matches)) {