From 1376e7667c166c00e713cbc19bec03fb05a42389 Mon Sep 17 00:00:00 2001
From: zhujinyong <zhujinyong@easycorp.ltd>
Date: Mon, 11 Sep 2023 14:10:27 +0800
Subject: [PATCH] - Reset commit.

---
 framework/base/router.class.php  | 1 -
 lib/base/filter/filter.class.php | 6 +++---
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/framework/base/router.class.php b/framework/base/router.class.php
index 64db3795f6..e3444e5e77 100644
--- a/framework/base/router.class.php
+++ b/framework/base/router.class.php
@@ -691,7 +691,6 @@ class baseRouter
         $_POST   = validater::filterSuper($_POST);
         $_GET    = validater::filterSuper($_GET);
         $_COOKIE = validater::filterSuper($_COOKIE);
-        $_SERVER = validater::filterSuper($_SERVER);
 
         /* Filter common get and cookie vars. */
         if($this->config->framework->filterParam == 2)
diff --git a/lib/base/filter/filter.class.php b/lib/base/filter/filter.class.php
index 74413a0f7c..78be1a0b93 100644
--- a/lib/base/filter/filter.class.php
+++ b/lib/base/filter/filter.class.php
@@ -661,11 +661,11 @@ class baseValidater
         global $config;
         if(empty($config->framework->filterXSS)) return $var;
 
-        if(stripos($var, '&lt;script') !== false || stripos($var, '<script') !== false || stripos($var, '&lt;iframe') !== false || stripos($var, '<iframe') !== false)
+        if(stripos($var, '&lt;script') !== false || stripos($var, '<script') !== false)
         {
             $var      = (string)$var;
-            $evils    = array('iframe', 'script', 'appendchild(', 'createElement(', 'xss.re', 'onfocus', 'onclick', 'innerHTML', 'replaceChild(', 'html(', 'append(', 'appendTo(', 'prepend(', 'prependTo(', 'after(', 'insertBefore', 'before(', 'replaceWith(', 'alert(', 'confirm(');
-            $replaces = array('ｉｆｒａｍｅ', 'ｓｃｒｉｐｔ', 'a p p e n d c h i l d (', 'c r e a t e E l e m e n t (', 'x s s . r e', 'o n f o c u s', 'o n c l i c k', 'i n n e r H T M L', 'r e p l a c e C h i l d (', 'h t m l (', 'a p p e n d (', 'a p p e n d T o (', 'p r e p e n d (', 'p r e p e n d T o (', 'a f t e r (', 'i n s e r t B e f o r e (', 'b e f o r e (', 'r e p l a c e W i t h (', 'a l e r t (', 'c o n f i r m (');
+            $evils    = array('appendchild(', 'createElement(', 'xss.re', 'onfocus', 'onclick', 'innerHTML', 'replaceChild(', 'html(', 'append(', 'appendTo(', 'prepend(', 'prependTo(', 'after(', 'insertBefore', 'before(', 'replaceWith(', 'alert(', 'confirm(');
+            $replaces = array('a p p e n d c h i l d (', 'c r e a t e E l e m e n t (', 'x s s . r e', 'o n f o c u s', 'o n c l i c k', 'i n n e r H T M L', 'r e p l a c e C h i l d (', 'h t m l (', 'a p p e n d (', 'a p p e n d T o (', 'p r e p e n d (', 'p r e p e n d T o (', 'a f t e r (', 'i n s e r t B e f o r e (', 'b e f o r e (', 'r e p l a c e W i t h (', 'a l e r t (', 'c o n f i r m (');
             $var      = str_ireplace($evils, $replaces, $var);
         }