1

I have a weird situation and I can't seem to find the answer on Google.

I am taking a javascript array, applying JSON.stringify to it, and then posting via AJAX to a php controller for storing the now json_encoded array in a table. Upon posting via ajax, the $_POST is somehow stripping the styles attribute on the html being submitted.

Here is the sample html being grabbed via javascript/jquery:

<"div class="blahblah" style="border:1px solid #000000;"><strong>test</strong></div>

Here is the AJAX post code:

var post_data = [];
    $("divclasshere").each(function(){
        post_data.push({html:$(this).html()});
    });
    var data = JSON.stringify(post_data); 
    $.ajax({
        type: "POST",
        url: "save",
        data: { content: data },
        success: function(result){
        }
    });

And here is the controller function that saves it to the db:

$data = array(
    'content' => $this->input->post('content')
);
$this->db->update('table', $data);

If I print_r on the data on the PHP controller, I get (example) 

<div class="blahblah"><strong>test</strong></div>

But no styles attribute on the div class="blahblah" element. I am using CodeIgniter if that makes a difference? In some cases, it strips the first part: style="border:1px and leaves solid #000000;"

EDIT:

Here is what gets posted (as an example):

content:[{"html":"<div class=\"content\" style=\"border:1px solid #000000;\"></div>"}]

And here is what gets print_r'd:

<pre>[{"html":"<div class=\"content\"  solid #000000;\"></div>"}]
4

1 に答える 1

3

コアの _remove_evil_attributes 関数は、スタイル属性をタグから削除します。この問題を解決するには、回避策があります。アプリケーションのコア ディレクトリ ( application/core/MY_security.php ) 内に My_Security.php というファイル名を作成し、その中に次のコードを貼り付けて、デフォルトの関数をオーバーライドします。

<?php if (!defined('BASEPATH')) exit('No direct script access allowed');
class MY_Security extends CI_Security {
    function __construct()
    {
      parent::__construct();
    }

    // --------------------------------------------------------------------

    /*
        * Modified for cb_cms
     */
    protected function _remove_evil_attributes($str, $is_image)
    {
        // All javascript event handlers (e.g. onload, onclick, onmouseover), style, and xmlns
        $allowed = array("your allowed url's without domain like '/admin/edittext/'");
        if(in_array($_SERVER['REQUEST_URI'],$allowed)){
            $evil_attributes = array('on\w*', 'xmlns');
        }else{
            $evil_attributes = array('on\w*', 'style', 'xmlns');
        }

        if ($is_image === TRUE)
        {
            /*
             * Adobe Photoshop puts XML metadata into JFIF images, 
             * including namespacing, so we have to allow this for images.
             */
            unset($evil_attributes[array_search('xmlns', $evil_attributes)]);
        }

        do {
            $str = preg_replace(
                "#<(/?[^><]+?)([^A-Za-z\-])(".implode('|', $evil_attributes).")(\s*=\s*)([\"][^>]*?[\"]|[\'][^>]*?[\']|[^>]*?)([\s><])([><]*)#i",
                "<$1$6",
                $str, -1, $count
            );
        } while ($count);

        return $str;
    }

} 
?>
于 2013-02-17T21:34:54.380 に答える