Index: branches/2.2/jabberit_messenger/jmessenger/js/trophyim.mini.js
===================================================================
--- branches/2.2/jabberit_messenger/jmessenger/js/trophyim.mini.js	(revision 3320)
+++ branches/2.2/jabberit_messenger/jmessenger/js/trophyim.mini.js	(revision 3325)
@@ -130,7 +130,11 @@
 {state="";chatStateOnOff=document.getElementById(jid_lower+"__chatStateOnOff");if(active.length>0&chatStateOnOff!=null)
 {chatStateOnOff.value='on';}
-var _message=document.createElement("div");_message.innerHTML=Strophe.getText(elems[0]);var scripts=_message.getElementsByTagName('script');for(var i=0;i<scripts.length;i++)
-_message.removeChild(scripts[i--]);var _imgSrc=_message.getElementsByTagName('img');for(var i=0;i<_imgSrc.length;i++)
-_message.removeChild(_imgSrc[i--]);_message.innerHTML=_message.innerHTML.replace(/^\s+|\s+$|^\n|\n$/g,"");_message.innerHTML=loadscript.getSmiles(_message.innerHTML);if(type=='chat'||type=='normal')
+var _message=document.createElement("div");var _text=Strophe.getText(elems[0]);_text=_text.replace(/onblur/gi,"EVENT_DENY");_text=_text.replace(/onchange/gi,"EVENT_DENY");_text=_text.replace(/onclick/gi,"EVENT_DENY");_text=_text.replace(/ondblclick/gi,"EVENT_DENY");_text=_text.replace(/onerror/gi,"EVENT_DENY");_text=_text.replace(/onfocus/gi,"EVENT_DENY");_text=_text.replace(/onkeydown/gi,"EVENT_DENY");_text=_text.replace(/onkeypress/gi,"EVENT_DENY");_text=_text.replace(/onkeyup/gi,"EVENT_DENY");_text=_text.replace(/onmousedown/gi,"EVENT_DENY");_text=_text.replace(/onmousemove/gi,"EVENT_DENY");_text=_text.replace(/onmouseout/gi,"EVENT_DENY");_text=_text.replace(/onmouseover/gi,"EVENT_DENY");_text=_text.replace(/onmouseup/gi,"EVENT_DENY");_text=_text.replace(/onresize/gi,"EVENT_DENY");_text=_text.replace(/onselect/gi,"EVENT_DENY");_text=_text.replace(/onunload/gi,"EVENT_DENY");_text=_text.replace(/style/gi,"EVENT_DENY");_message.innerHTML=_text;var scripts=_message.getElementsByTagName('script');for(var i=0;i<scripts.length;i++){_message.removeChild(scripts[i--]);}
+var _imgSrc=_message.getElementsByTagName('img');for(var i=0;i<_imgSrc.length;i++){_message.removeChild(_imgSrc[i--]);}
+var _Div=_message.getElementsByTagName('div');for(var i=0;i<_Div.length;i++){_message.removeChild(_Div[i--]);}
+var _Span=_message.getElementsByTagName('span');for(var i=0;i<_Span.length;i++){_message.removeChild(_Span[i--]);}
+var _Iframe=_message.getElementsByTagName('iframe');for(var i=0;i<_Iframe.length;i++){_message.removeChild(_Iframe[i--]);}
+var _aHref=_message.getElementsByTagName('a');for(var i=0;i<_aHref.length;i++){_message.removeChild(_aHref[i--]);}
+_message.innerHTML=_message.innerHTML.replace(/^\s+|\s+$|^\n|\n$/g,"");_message.innerHTML=loadscript.getSmiles(_message.innerHTML);if(type=='chat'||type=='normal')
 {if(_message.hasChildNodes())
 {var message={contact:"["+stamp+"] <font style='font-weight:bold; color:black;'>"+contact+"</font>",msg:"</br>"+_message.innerHTML};TrophyIM.addMessage(TrophyIM.makeChat(from),jid_lower,message);}}
Index: branches/2.2/jabberit_messenger/jmessenger/js/trophyim.js
===================================================================
--- branches/2.2/jabberit_messenger/jmessenger/js/trophyim.js	(revision 3320)
+++ branches/2.2/jabberit_messenger/jmessenger/js/trophyim.js	(revision 3325)
@@ -810,20 +810,79 @@
 
 			// Get Message
-			var _message = document.createElement("div");
-			_message.innerHTML = Strophe.getText(elems[0]);
-			
+			var _message	= document.createElement("div");
+			var _text		= Strophe.getText( elems[0] );
+			
+			// Events Javascript
+			_text = _text.replace(/onblur/gi,"EVENT_DENY");
+			
+			_text = _text.replace(/onchange/gi,"EVENT_DENY");
+			
+			_text = _text.replace(/onclick/gi,"EVENT_DENY");
+			
+			_text = _text.replace(/ondblclick/gi,"EVENT_DENY");
+			
+			_text = _text.replace(/onerror/gi,"EVENT_DENY");
+			
+			_text = _text.replace(/onfocus/gi,"EVENT_DENY");
+			
+			_text = _text.replace(/onkeydown/gi,"EVENT_DENY");
+			
+			_text = _text.replace(/onkeypress/gi,"EVENT_DENY");
+			
+			_text = _text.replace(/onkeyup/gi,"EVENT_DENY");
+			
+			_text = _text.replace(/onmousedown/gi,"EVENT_DENY");
+			
+			_text = _text.replace(/onmousemove/gi,"EVENT_DENY");
+			
+			_text = _text.replace(/onmouseout/gi,"EVENT_DENY");
+			
+			_text = _text.replace(/onmouseover/gi,"EVENT_DENY");
+			
+			_text = _text.replace(/onmouseup/gi,"EVENT_DENY");
+			
+			_text = _text.replace(/onresize/gi,"EVENT_DENY");
+			
+			_text = _text.replace(/onselect/gi,"EVENT_DENY");
+			
+			_text = _text.replace(/onunload/gi,"EVENT_DENY");
+			
+			// Events CSS
+			_text = _text.replace(/style/gi,"EVENT_DENY");
+
+			_message.innerHTML = _text;
+			
+			////////// BEGIN XSS //////////////////////////////////////////////////
 			// Delete Tags <SCRIPT>
 			var scripts = _message.getElementsByTagName('script');
-			
-			for (var i = 0; i < scripts.length; i++) 
-				_message.removeChild(scripts[i--]);
+			for (var i = 0; i < scripts.length; i++){ _message.removeChild(scripts[i--]); }
+			////////////////////////////////////////////////////
 			
 			// Delete Tags <IMG>
 			var _imgSrc = _message.getElementsByTagName('img');
-			
-			for (var i = 0; i < _imgSrc.length; i++) 
-				_message.removeChild( _imgSrc[i--] );
-
+			for (var i = 0; i < _imgSrc.length; i++){ _message.removeChild( _imgSrc[i--] ); }
+			////////////////////////////////////////////////////
+			
+			// Delete Tags <DIV>
+			var _Div = _message.getElementsByTagName('div');
+			for (var i = 0; i < _Div.length; i++){ _message.removeChild( _Div[i--] ); }
+			////////////////////////////////////////////////////
+			
+			// Delete Tags <SPAN>
+			var _Span = _message.getElementsByTagName('span');
+			for (var i = 0; i < _Span.length; i++){ _message.removeChild( _Span[i--] ); }
+			////////////////////////////////////////////////////
+
+			// Delete Tags <IFRAME>
+			var _Iframe = _message.getElementsByTagName('iframe');
+			for (var i = 0; i < _Iframe.length; i++){ _message.removeChild( _Iframe[i--] ); }
+
+			// Delete Tags <A HREF>
+			var _aHref = _message.getElementsByTagName('a');
+			for (var i = 0; i < _aHref.length; i++){ _message.removeChild( _aHref[i--] ); }
+
+			
 			_message.innerHTML = _message.innerHTML.replace(/^\s+|\s+$|^\n|\n$/g, "");
+			////////// END XSS //////////////////////////////////////////////////
 			
 			// Get Smiles
