From aa0b81f0a68d5bbe349cb3205d3ac1c750762467 Mon Sep 17 00:00:00 2001
From: mayue <mayue@easycorp.ltd>
Date: Wed, 18 May 2022 07:19:19 +0000
Subject: [PATCH] * Fix bug #22246.

---
 lib/base/filter/filter.class.php | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/base/filter/filter.class.php b/lib/base/filter/filter.class.php
index 8db2523369..fda784c2a2 100644
--- a/lib/base/filter/filter.class.php
+++ b/lib/base/filter/filter.class.php
@@ -661,11 +661,11 @@ class baseValidater
         global $config;
         if(empty($config->framework->filterXSS)) return $var;
 
-        if(stripos($var, '<script') !== false)
+        if(stripos($var, '&lt;script') !== false or stripos($var, '<script') !== false)
         {
             $var      = (string)$var;
-            $evils    = array('appendchild(', 'createElement(', 'xss.re', 'onfocus', 'onclick', 'innerHTML', 'replaceChild(', 'html(', 'append(', 'appendTo(', 'prepend(', 'prependTo(', 'after(', 'insertBefore', 'before(', 'replaceWith(');
-            $replaces = array('a p p e n d c h i l d (', 'c r e a t e E l e m e n t (', 'x s s . r e', 'o n f o c u s', 'o n c l i c k', 'i n n e r H T M L', 'r e p l a c e C h i l d (', 'h t m l (', 'a p p e n d (', 'a p p e n d T o (', 'p r e p e n d (', 'p r e p e n d T o (', 'a f t e r (', 'i n s e r t B e f o r e (', 'b e f o r e (', 'r e p l a c e W i t h (');
+            $evils    = array('appendchild(', 'createElement(', 'xss.re', 'onfocus', 'onclick', 'innerHTML', 'replaceChild(', 'html(', 'append(', 'appendTo(', 'prepend(', 'prependTo(', 'after(', 'insertBefore', 'before(', 'replaceWith(', 'alert(', 'confirm(');
+            $replaces = array('a p p e n d c h i l d (', 'c r e a t e E l e m e n t (', 'x s s . r e', 'o n f o c u s', 'o n c l i c k', 'i n n e r H T M L', 'r e p l a c e C h i l d (', 'h t m l (', 'a p p e n d (', 'a p p e n d T o (', 'p r e p e n d (', 'p r e p e n d T o (', 'a f t e r (', 'i n s e r t B e f o r e (', 'b e f o r e (', 'r e p l a c e W i t h (', 'a l e r t (', 'c o n f i r m (');
             $var      = str_ireplace($evils, $replaces, $var);
         }