From 786eaa4b038cd1e9a99cd0857229e545515a01ac Mon Sep 17 00:00:00 2001
From: ahmad-curriki <68377680+ahmad-curriki@users.noreply.github.com>
Date: Tue, 25 Aug 2020 15:04:10 +0500
Subject: [PATCH] Allowing to add multiple style properties per element
 [CKEditor]

As some CK-Editor addons could include multiple properties for style attribute separated by ";".
Allowed some more style properties and also allowed the multiple style properties per element.
---
 h5p.classes.php | 27 +++++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/h5p.classes.php b/h5p.classes.php
index a6104313..8f3237a4 100644
--- a/h5p.classes.php
+++ b/h5p.classes.php
@@ -3633,6 +3633,8 @@ public function validateText(&$text, $semantics) {
       $stylePatterns = array();
       // All styles must be start to end patterns (^...$)
       if (isset($semantics->font)) {
+        $stylePatterns[] = '/^font-style: *(italic|normal|oblique);?$/i'; // allow font-style property
+        $stylePatterns[] = '/^font-weight: *[0-9.]+;?$/i'; // allow font-weight property
         if (isset($semantics->font->size) && $semantics->font->size) {
           $stylePatterns[] = '/^font-size: *[0-9.]+(em|px|%) *;?$/i';
         }
@@ -3655,6 +3657,14 @@ public function validateText(&$text, $semantics) {
 
       // Alignment is allowed for all wysiwyg texts
       $stylePatterns[] = '/^text-align: *(center|left|right);?$/i';
+      // other necessary style tags - allowing additional tags
+      $stylePatterns[] = "/^width: *[0-9.]+(px|%) *;?$/i";
+      $stylePatterns[] = "/^height: *[0-9.]+(px|%) *;?$/i";
+      $stylePatterns[] = "/^margin: *[0-9.]+(em|px|%)+(\s(#?)([a-z0-9]{3,6})){0,3} *;?$/i";
+      $stylePatterns[] = "/^padding: *[0-9.]+(em|px|%)+(\s(#?)([a-z0-9]{3,6})){0,3} *;?$/i";
+      $stylePatterns[] = "/^padding(-(top|bottom|right|left)): *[0-9.]+(em|px|%) *;?$/i";
+      $stylePatterns[] = "/^margin(-(top|bottom|right|left)): *[0-9.]+(em|px|%) *;?$/i";
+      $stylePatterns[] = "/^border(-(top|bottom|right|left)|):(\s?)(([0-9.]*)+(em|px|%))+(\s(#?)[a-z0-9]{3,6}){0,2} *;?$/i";
 
       // Strip invalid HTML tags.
       $text = $this->filter_xss($text, $tags, $stylePatterns);
@@ -4342,14 +4352,23 @@ private function _filter_xss_attributes($attr, $allowedStyles = FALSE) {
           // Attribute value, a URL after href= for instance.
           if (preg_match('/^"([^"]*)"(\s+|$)/', $attr, $match)) {
             if ($allowedStyles && $attrName === 'style') {
+              $matches = explode(";", $match[1]); // get all the style properties
               // Allow certain styles
+              $styleArr = [];
               foreach ($allowedStyles as $pattern) {
-                if (preg_match($pattern, $match[1])) {
-                  // All patterns are start to end patterns, and CKEditor adds one span per style
-                  $attrArr[] = 'style="' . $match[1] . '"';
-                  break;
+                foreach ($matches as $match) { // loop through each style property of an element
+                  if (preg_match($pattern, trim($match))) { // add the property in styleArr if exist in allowed style array
+                    // All patterns are start to end patterns, and CKEditor adds one span per style
+                    // overriding the CKEditor one style per span logic - as some addon might add multiple style attributes per element
+                    $styleArr[] = $match;
+                    // break; this break not needed anymore for allowing multiple style properties per element
+                  }
                 }
               }
+              // if style array has some style properties then prepare final style attribute for element
+              if (!empty($styleArr)) {
+                  $attrArr[] = 'style="' . implode(";", $styleArr) . '"';
+              }
               break;
             }