Forums / Bug Reports / [Done v1.6.0] Product description listing: inline javascript may not be stripped

[Done v1.6.0] Product description listing: inline javascript may not be stripped

Locked

Views: 1,593

Results 1 to 3 of 3
This thread is locked. New replies are disabled.
12 Mar 2013, 10:42 PM
#1
torvista avatar

torvista

Totally Zenned

Join Date:
Aug 2007
Location:
Gijón, Asturias, Spain
Posts:
2,875
Plugin Contributions:
7

[Done v1.6.0] Product description listing: inline javascript may not be stripped

Not sure whether this would be classed as a bug but function zen_clean_html does not get rid of inline javascript in the product description cleanly/completely.

Why is there javascript in the product description: I have a few products that use an expanding table function which I really don't need to be loaded globally on all product pages so its used in that product description only.

This results in this type of thing in the product listing:

Singled-sided paddock stand pins are available in a range of outer diameters, choose the one appropriate for the inner diameter of your bike hub. $(document).ready(function() {$("table").tablesorter({widgets: ["zebra"],

from this source

<p>Singled-sided paddock stand pins are available in a range of outer diameters, choose the one appropriate for the inner diameter of your bike hub.</p> <script type="text/javascript" src="includes/templates/My template/jscript/jquery.tablesorter.js"></script> <script type="text/javascript">$(document).ready(function() {$("table").tablesorter({widgets: ["zebra"], widgetOptions:{zebra:["normal-row", "alt-row"]}});});</script>

Suggestions?

Steve
github.com/torvista: BackupMySQL, Structured Data, Multiple Copy-Move-Delete, Google reCaptcha, Image Checker, Spanish Language Pack and more...

25 May 2013, 3:16 AM
#2
drbyte avatar

drbyte

Sensei

Join Date:
Jan 2004
Posts:
63,513
Plugin Contributions:
176

Re: [Done v1.6.0] Product description listing: inline javascript may not be stripped

I suspect the following will accomplish the task. I'd be interested in knowing any negative effects you encounter by using it:

    if (!is_array($extraTags)) $extraTags = array($extraTags);

[B]    // remove any embedded javascript
    $clean_it = preg_replace('#<script(.*?)>(.*?)</script>#is', '', $clean_it);
[/B]
    $clean_it = preg_replace('/\r/', ' ', $clean_it);

.
Zen Cart - putting the dream of business ownership within reach of anyone!
Donate to: DrByte directly or to the Zen Cart team as a whole

Remember: Any code suggestions you see here are merely suggestions. You assume full responsibility for your use of any such suggestions, including any impact ANY alterations you make to your site may have on your PCI compliance.
Furthermore, any advice you see here about PCI matters is merely an opinion, and should not be relied upon as "official". Official PCI information should be obtained from the PCI Security Council directly or from one of their authorized Assessors.

11 Aug 2013, 3:09 PM
#3
torvista avatar

torvista

Totally Zenned

Join Date:
Aug 2007
Location:
Gijón, Asturias, Spain
Posts:
2,875
Plugin Contributions:
7

Re: [Done v1.6.0] Product description listing: inline javascript may not be stripped

forgot about this....but yes it works fine!

thanks

Steve
github.com/torvista: BackupMySQL, Structured Data, Multiple Copy-Move-Delete, Google reCaptcha, Image Checker, Spanish Language Pack and more...