diff --git a/htdocs/core/lib/website.lib.php b/htdocs/core/lib/website.lib.php index 6ffebce4688..8dd4e625d9d 100644 --- a/htdocs/core/lib/website.lib.php +++ b/htdocs/core/lib/website.lib.php @@ -528,8 +528,10 @@ function includeContainer($containerref) } /** - * Return HTML content to add structured data for an article, news or Blog Post. - * Use the json-ld format. + * Return HTML content to add structured data for an article, news or Blog Post. Use the json-ld format. + * Example: + * + * 'Name', 'os'=>'Windows', 'price'=>10)); ?> * * @param string $type 'blogpost', 'product', 'software', 'organization', 'qa', ... * @param array $data Array of data parameters for structured data diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php index 7775071a55c..09f3f85b7e4 100644 --- a/htdocs/main.inc.php +++ b/htdocs/main.inc.php @@ -146,7 +146,7 @@ function testSqlAndScriptInject($val, $type) $inj += preg_match('/=data:/si', $val); // List of dom events is on https://www.w3schools.com/jsref/dom_obj_event.asp and https://developer.mozilla.org/en-US/docs/Web/API/GlobalEventHandlers $inj += preg_match('/on(mouse|drag|key|load|touch|pointer|select|transition)([a-z]*)\s*=/i', $val); // onmousexxx can be set on img or any html tag like - $inj += preg_match('/on(abort|afterprint|animation|auxclick|beforeprint|beforeunload|blur|cancel|canplay|canplaythrough|change|click|close|contextmenu|cuechange|copy|cut)\s*=/i', $val); + $inj += preg_match('/on(abort|afterprint|animation|auxclick|beforecopy|beforecut|beforeprint|beforeunload|blur|cancel|canplay|canplaythrough|change|click|close|contextmenu|cuechange|copy|cut)\s*=/i', $val); $inj += preg_match('/on(dblclick|drop|durationchange|emptied|ended|error|focus|focusin|focusout|formdata|gotpointercapture|hashchange|input|invalid)\s*=/i', $val); $inj += preg_match('/on(lostpointercapture|offline|online|pagehide|pageshow)\s*=/i', $val); $inj += preg_match('/on(paste|pause|play|playing|progress|ratechange|reset|resize|scroll|search|seeked|seeking|show|stalled|start|submit|suspend)\s*=/i', $val);