clean.setVerified() does not properly escape the RegEx string

diff --git a/wcfsetup/install/files/js/3rdParty/redactor/plugins/wmonkeypatch.js b/wcfsetup/install/files/js/3rdParty/redactor/plugins/wmonkeypatch.js
index 1296d02968f73cf34375c54c96e1da33fa89d07d..9540ca7ef009efdd810e94c5b4e892d32bfa84aa 100644 (file)
--- a/wcfsetup/install/files/js/3rdParty/redactor/plugins/wmonkeypatch.js
+++ b/wcfsetup/install/files/js/3rdParty/redactor/plugins/wmonkeypatch.js
@@ -105,6 +105,7 @@ RedactorPlugins.wmonkeypatch = function() {
                 *  - convert <div> to <p> during paste
                 */
                clean: function() {
+                       // clean.onPaste
                        var $mpOnPaste = this.clean.onPaste;
                        this.clean.onPaste = (function(html, setMode) {
                                this.opts.replaceDivs = true;
@@ -115,6 +116,25 @@ RedactorPlugins.wmonkeypatch = function() {
                                
                                return html;
                        }).bind(this);
+                       
+                       // clean.setVerified
+                       this.clean.setVerified = (function(html) {
+                               if (this.utils.browser('msie')) return html;
+                               
+                               html = html.replace(new RegExp('<img(.*?[^>])>', 'gi'), '<img$1 data-verified="redactor">');
+                               html = html.replace(new RegExp('<span(.*?)>', 'gi'), '<span$1 data-verified="redactor">');
+                               
+                               var matches = html.match(new RegExp('<(span|img)(.*?)style="(.*?)"(.*?[^>])>', 'gi'));
+                               if (matches) {
+                                       var len = matches.length;
+                                       for (var i = 0; i < len; i++) {
+                                               var newTag = matches[i].replace(/style="(.*?)"/i, 'style="$1" rel="$1"');
+                                               html = html.replace(new RegExp(WCF.String.escapeRegExp(matches[i]), 'gi'), newTag);
+                                       }
+                               }
+                               
+                               return html;
+                       }).bind(this);
                },
                
                /**