- Fix bug in handling of base href and inline content (#1488290)

2 files changed, 62 insertions, 47 deletions

diff --git a/program/include/main.inc b/program/include/main.inc
index ad41a13e7..b16f0202a 100644
--- a/program/include/main.inc
+++ b/program/include/main.inc
@@ -2093,7 +2093,68 @@ class rcube_base_replacer
 
   public function callback($matches)
   {
-    return $matches[1] . '="' . make_absolute_url($matches[3], $this->base_url) . '"';
+    return $matches[1] . '="' . self::absolute_url($matches[3], $this->base_url) . '"';
+  }
+
+  public function replace($body)
+  {
+    return preg_replace_callback(array(
+      '/(src|background|href)=(["\']?)([^"\'\s]+)(\2|\s|>)/Ui',
+      '/(url\s*\()(["\']?)([^"\'\)\s]+)(\2)\)/Ui',
+      ),
+      array($this, 'callback'), $body);
+  }
+
+  /**
+   * Convert paths like ../xxx to an absolute path using a base url
+   *
+   * @param string $path     Relative path
+   * @param string $base_url Base URL
+   *
+   * @return string Absolute URL
+   */
+  public static function absolute_url($path, $base_url)
+  {
+    $host_url = $base_url;
+    $abs_path = $path;
+
+    // check if path is an absolute URL
+    if (preg_match('/^[fhtps]+:\/\//', $path)) {
+      return $path;
+    }
+
+    // check if path is a content-id scheme
+    if (strpos($path, 'cid:') === 0) {
+      return $path;
+    }
+
+    // cut base_url to the last directory
+    if (strrpos($base_url, '/') > 7) {
+      $host_url = substr($base_url, 0, strpos($base_url, '/', 7));
+      $base_url = substr($base_url, 0, strrpos($base_url, '/'));
+    }
+
+    // $path is absolute
+    if ($path[0] == '/') {
+      $abs_path = $host_url.$path;
+    }
+    else {
+      // strip './' because its the same as ''
+      $path = preg_replace('/^\.\//', '', $path);
+
+      if (preg_match_all('/\.\.\//', $path, $matches, PREG_SET_ORDER)) {
+        foreach ($matches as $a_match) {
+          if (strrpos($base_url, '/')) {
+            $base_url = substr($base_url, 0, strrpos($base_url, '/'));
+          }
+          $path = substr($path, 3);
+        }
+      }
+
+      $abs_path = $base_url.'/'.$path;
+    }
+
+    return $abs_path;
   }
 }
 
diff --git a/program/include/rcube_shared.inc b/program/include/rcube_shared.inc
index abaa8aa03..aef08341d 100644
--- a/program/include/rcube_shared.inc
+++ b/program/include/rcube_shared.inc
@@ -164,52 +164,6 @@ function show_bytes($bytes)
 }
 
 /**
- * Convert paths like ../xxx to an absolute path using a base url
- *
- * @param string Relative path
- * @param string Base URL
- * @return string Absolute URL
- */
-function make_absolute_url($path, $base_url)
-{
-  $host_url = $base_url;
-  $abs_path = $path;
-
-  // check if path is an absolute URL
-  if (preg_match('/^[fhtps]+:\/\//', $path))
-    return $path;
-
-  // cut base_url to the last directory
-  if (strrpos($base_url, '/')>7)
-  {
-    $host_url = substr($base_url, 0, strpos($base_url, '/', 7));
-    $base_url = substr($base_url, 0, strrpos($base_url, '/'));
-  }
-
-  // $path is absolute
-  if ($path[0] == '/')
-    $abs_path = $host_url.$path;
-  else
-  {
-    // strip './' because its the same as ''
-    $path = preg_replace('/^\.\//', '', $path);
-
-    if (preg_match_all('/\.\.\//', $path, $matches, PREG_SET_ORDER))
-      foreach ($matches as $a_match)
-      {
-        if (strrpos($base_url, '/'))
-          $base_url = substr($base_url, 0, strrpos($base_url, '/'));
-
-        $path = substr($path, 3);
-      }
-
-    $abs_path = $base_url.'/'.$path;
-  }
-
-  return $abs_path;
-}
-
-/**
  * Wrapper function for wordwrap
  */
 function rc_wordwrap($string, $width=75, $break="\n", $cut=false)