From 55f0051db2c401f9ccd34f1737a89dda8f039a24 Mon Sep 17 00:00:00 2001
From: Laurent Destailleur <eldy@destailleur.fr>
Date: Fri, 30 Aug 2019 15:17:13 +0200
Subject: [PATCH] Html tag <marquee are forbidden

---
 htdocs/main.inc.php | 1 +
 1 file changed, 1 insertion(+)

diff --git a/htdocs/main.inc.php b/htdocs/main.inc.php
index 65464d724b1..575a88fbd28 100644
--- a/htdocs/main.inc.php
+++ b/htdocs/main.inc.php
@@ -108,6 +108,7 @@ function testSqlAndScriptInject($val, $type)
 	$inj += preg_match('/<script/i', $val);
 	$inj += preg_match('/<iframe/i', $val);
 	$inj += preg_match('/<audio/i', $val);
+	$inj += (stripos('/<marquee/i', $val) === false ? 0 : 1);
 	$inj += preg_match('/Set\.constructor/i', $val);	// ECMA script 6
 	if (! defined('NOSTYLECHECK')) $inj += preg_match('/<style/i', $val);
 	$inj += preg_match('/base[\s]+href/si', $val);