diff options
author | Aleksander Machniak <alec@alec.pl> | 2012-11-08 09:05:35 +0100 |
---|---|---|
committer | Aleksander Machniak <alec@alec.pl> | 2012-11-08 09:06:47 +0100 |
commit | a92582f3b84157a2f5cc04d82f7e6d2f19b80fa5 (patch) | |
tree | 848fcf97cbfb9110cff755bf0babe0189f9bedd2 | |
parent | 4f72978af37a72ddf9c5bfb9b78930417c9c9d2a (diff) |
Fix AREA links handling (#1488792)
Conflicts:
CHANGELOG
-rw-r--r-- | CHANGELOG | 1 | ||||
-rw-r--r-- | program/lib/washtml.php | 2 | ||||
-rw-r--r-- | program/steps/mail/func.inc | 8 |
3 files changed, 8 insertions, 3 deletions
@@ -1,6 +1,7 @@ CHANGELOG Roundcube Webmail =========================== +- Fix AREA links handling (#1488792) - Fix possible HTTP DoS on error in keep-alive requests (#1488782) - Fix compatybility with MDB2 2.5.0b4 (#1488779) - Fix a bug where saving a message in INBOX wasn't possible diff --git a/program/lib/washtml.php b/program/lib/washtml.php index 98ae5ed5a..d5cdb82f8 100644 --- a/program/lib/washtml.php +++ b/program/lib/washtml.php @@ -102,7 +102,7 @@ class washtml 'cellpadding', 'valign', 'bgcolor', 'color', 'border', 'bordercolorlight', 'bordercolordark', 'face', 'marginwidth', 'marginheight', 'axis', 'border', 'abbr', 'char', 'charoff', 'clear', 'compact', 'coords', 'vspace', 'hspace', - 'cellborder', 'size', 'lang', 'dir', 'usemap', + 'cellborder', 'size', 'lang', 'dir', 'usemap', 'shape', // attributes of form elements 'type', 'rows', 'cols', 'disabled', 'readonly', 'checked', 'multiple', 'value' ); diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc index 732719014..2c6db01eb 100644 --- a/program/steps/mail/func.inc +++ b/program/steps/mail/func.inc @@ -1234,7 +1234,7 @@ function rcmail_html4inline($body, $container_id, $body_id='', &$attributes=null // modify HTML links to open a new window if clicked $GLOBALS['rcmail_html_container_id'] = $container_id; - $body = preg_replace_callback('/<(a|link)\s+([^>]+)>/Ui', 'rcmail_alter_html_link', $body); + $body = preg_replace_callback('/<(a|link|area)\s+([^>]+)>/Ui', 'rcmail_alter_html_link', $body); unset($GLOBALS['rcmail_html_container_id']); $body = preg_replace(array( @@ -1347,7 +1347,11 @@ function rcmail_alter_html_link($matches) $attrib['target'] = '_blank'; } - return "<$tag" . html::attrib_string($attrib, array('href','name','target','onclick','id','class','style','title','rel','type','media')) . $end; + // allowed attributes for a|link|area tags + $allow = array('href','name','target','onclick','id','class','style','title', + 'rel','type','media','alt','coords','nohref','hreflang','shape'); + + return "<$tag" . html::attrib_string($attrib, $allow) . $end; } |