Disable textile inline styles to prevent XSS attacks (#2377).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@2192 e93f8b46-1217-0410-a6f0-8f06a7374b81

lib/redcloth3.rb

@@ -470,8 +470,7 @@ class RedCloth3 < String
             style << "vertical-align:#{ v_align( $& ) };" if text =~ A_VLGN
         end
 
-        style << "#{ htmlesc $1 };" if not filter_styles and
-            text.sub!( /\{([^}]*)\}/, '' )
+        style << "#{ htmlesc $1 };" if text.sub!( /\{([^}]*)\}/, '' ) && !filter_styles
 
         lang = $1 if
             text.sub!( /\[([^)]+?)\]/, '' )

lib/redmine/wiki_formatting/textile/formatter.rb

@@ -30,6 +30,7 @@ module Redmine
           super
           self.hard_breaks=true
           self.no_span_caps=true
+          self.filter_styles=true
         end
         
         def to_html(*rules, &block)