MDL-2684: kses strips out CSS from style tags unless the first property is on 'allowe...

diff --git a/lib/kses.php b/lib/kses.php
index 5824fa0..8d87c23 100644 (file)
--- a/lib/kses.php
+++ b/lib/kses.php
@@ -311,7 +311,12 @@ function kses_hair($attr, $allowed_protocols)
         if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match))
          # "value"
         {
-          $thisval = kses_bad_protocol($match[1], $allowed_protocols);
+          // MDL-2684 - kses stripping CSS styles that it thinks look like protocols
+          if ($attrname == 'style') {
+              $thisval = $match[1];
+          } else {
+              $thisval = kses_bad_protocol($match[1], $allowed_protocols);
+          }
 
           $attrarr[] = array
                         ('name'  => $attrname,