fixed all JS code should be stripped from inline CSS

Erudika · Nov 26, 2021 · d5c2bc5 · d5c2bc5
1 parent efb5707
commit d5c2bc5
Showing 1 changed file with 1 addition and 2 deletions.
diff --git a/src/main/java/com/erudika/scoold/utils/ScooldUtils.java b/src/main/java/com/erudika/scoold/utils/ScooldUtils.java
@@ -1780,8 +1780,7 @@ public String getInlineCSS() {
 					FILE_CACHE.put("theme", themeName);
 				}
 			}
-			loadedTheme = StringUtils.replaceEachRepeatedly(loadedTheme,
-					new String[] {"<", "</", "<script", "<SCRIPT"}, new String[] {"", "", "", ""});
+			loadedTheme = StringEscapeUtils.escapeEcmaScript(loadedTheme);
 			return loadedTheme + "\n/*** END OF THEME CSS ***/\n" + inline;
 		} catch (Exception e) {
 			logger.debug("Failed to load inline CSS.");