diff --git a/src/Umbraco.Core/StringExtensions.cs b/src/Umbraco.Core/StringExtensions.cs index 9ee33a286b..be5820cdf8 100644 --- a/src/Umbraco.Core/StringExtensions.cs +++ b/src/Umbraco.Core/StringExtensions.cs @@ -170,13 +170,14 @@ namespace Umbraco.Core /// Cleans string to aid in preventing xss attacks. /// /// + /// /// - internal static string CleanForXss(this string input) + internal static string CleanForXss(this string input, params char[] ignoreFromClean) { //remove any html input = input.StripHtml(); //strip out any potential chars involved with XSS - return input.ExceptChars(new HashSet("*?(){}[];:%<>/\\|&'\"".ToCharArray())); + return input.ExceptChars(new HashSet("*?(){}[];:%<>/\\|&'\"".ToCharArray().Except(ignoreFromClean))); } public static string ExceptChars(this string str, HashSet toExclude) diff --git a/src/Umbraco.Web/umbraco.presentation/umbraco/settings/stylesheet/editstylesheet.aspx.cs b/src/Umbraco.Web/umbraco.presentation/umbraco/settings/stylesheet/editstylesheet.aspx.cs index c0b90bd29a..ce19c7991c 100644 --- a/src/Umbraco.Web/umbraco.presentation/umbraco/settings/stylesheet/editstylesheet.aspx.cs +++ b/src/Umbraco.Web/umbraco.presentation/umbraco/settings/stylesheet/editstylesheet.aspx.cs @@ -78,7 +78,7 @@ namespace umbraco.cms.presentation.settings.stylesheet ScriptManager.GetCurrent(Page).Services.Add(new ServiceReference("../webservices/legacyAjaxCalls.asmx")); //Clean the name field for xss - NameTxt.Text = NameTxt.Text.CleanForXss(); + NameTxt.Text = NameTxt.Text.CleanForXss(ignoreFromClean:'\\'); } ///