Merge branch 'release-0.9' of github.com:roundcube/roundcubemail into release-0.9

4 files changed, 69 insertions, 4 deletions

diff --git a/program/steps/mail/compose.inc b/program/steps/mail/compose.inc
index 73a7f34ac..fb76b9abb 100644
--- a/program/steps/mail/compose.inc
+++ b/program/steps/mail/compose.inc
@@ -198,7 +198,10 @@ if (!empty($msg_uid) && empty($COMPOSE['as_attachment']))
   if (!empty($MESSAGE->headers->charset))
     $RCMAIL->storage->set_charset($MESSAGE->headers->charset);
 
-  if ($compose_mode == RCUBE_COMPOSE_REPLY) {
+  if (!$MESSAGE->headers) {
+    // error
+  }
+  else if ($compose_mode == RCUBE_COMPOSE_REPLY) {
     $COMPOSE['reply_uid'] = $msg_uid;
     $COMPOSE['reply_msgid'] = $MESSAGE->headers->messageID;
     $COMPOSE['references']  = trim($MESSAGE->headers->references . " " . $MESSAGE->headers->messageID);
@@ -980,10 +983,19 @@ function rcmail_create_draft_body($body, $bodyIsHtml)
       && count($MESSAGE->mime_parts) > 0)
   {
     $cid_map = rcmail_write_compose_attachments($MESSAGE, $bodyIsHtml);
+  }
+
+  // clean up HTML tags - XSS prevention (#1489251)
+  if ($bodyIsHtml) {
+    $body = rcmail_wash_html($body, array('safe' => 1), $cid_map);
+
+    // remove comments (produced by washtml)
+    $body = preg_replace('/<!--[^>]+-->/', '', $body);
 
     // replace cid with href in inline images links
-    if ($cid_map)
+    if (!empty($cid_map)) {
       $body = str_replace(array_keys($cid_map), array_values($cid_map), $body);
+    }
   }
 
   return $body;
diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc
index 16a9f495d..28e6baadf 100644
--- a/program/steps/mail/func.inc
+++ b/program/steps/mail/func.inc
@@ -1803,8 +1803,14 @@ function rcmail_identity_select($MESSAGE, $identities = null, $compose_mode = 'r
     // Try Return-Path
     if ($from_idx === null && ($return_path = $MESSAGE->headers->others['return-path'])) {
         foreach ($identities as $idx => $ident) {
+            // Return-Path header contains an email address, but on some mailing list
+            // it can be e.g. <pear-dev-return-55250-local=domain.tld@lists.php.net>
+            // where local@domain.tld is the address we're looking for (#1489241)
+            $ident1 = $ident['email_ascii'];
+            $ident2 = str_replace('@', '=', $ident1);
+
             foreach ((array)$return_path as $path) {
-                if (stripos($path, $ident['email_ascii']) !== false) {
+                if (stripos($path, $ident1) !== false || stripos($path, $ident2)) {
                     $from_idx = $idx;
                     break 2;
                 }
diff --git a/program/steps/settings/edit_identity.inc b/program/steps/settings/edit_identity.inc
index d70a7aef7..edd4ba60d 100644
--- a/program/steps/settings/edit_identity.inc
+++ b/program/steps/settings/edit_identity.inc
@@ -77,7 +77,7 @@ function rcube_identity_form($attrib)
     'signature' => array(
       'name' => rcube_label('signature'),
       'content' => array(
-        'signature'	     => array('type' => 'textarea', 'size' => $t_cols, 'rows' => $t_rows,
+        'signature'      => array('type' => 'textarea', 'size' => $t_cols, 'rows' => $t_rows,
             'spellcheck' => true),
         'html_signature' => array('type' => 'checkbox', 'label' => rcube_label('htmlsignature'),
             'onclick' => 'return rcmail_toggle_editor(this, \'rcmfd_signature\');'),
@@ -138,6 +138,7 @@ function rcube_identity_form($attrib)
 
         $label = !empty($colprop['label']) ? $colprop['label'] :
             rcube_label(str_replace('-', '', $col));
+
         $value = !empty($colprop['value']) ? $colprop['value'] :
             rcmail_get_edit_field($col, $IDENTITY_RECORD[$col], $colprop, $colprop['type']);
 
diff --git a/program/steps/settings/save_identity.inc b/program/steps/settings/save_identity.inc
index 34d8be268..d3b132f8b 100644
--- a/program/steps/settings/save_identity.inc
+++ b/program/steps/settings/save_identity.inc
@@ -76,6 +76,15 @@ foreach ($email_checks as $email) {
   }
 }
 
+// XSS protection in HTML signature (#1489251)
+if (!empty($save_data['signature']) && !empty($save_data['html_signature'])) {
+  $save_data['signature'] = rcmail_wash_html($save_data['signature']);
+
+  // clear POST data of signature, we want to use safe content
+  // when the form is displayed again
+  unset($_POST['_signature']);
+}
+
 // update an existing contact
 if ($_POST['_iid']) {
   $iid = get_input_value('_iid', RCUBE_INPUT_POST);
@@ -167,3 +176,40 @@ if (!empty($_REQUEST['_framed'])) {
 }
 else
   rcmail_overwrite_action('identities');
+
+
+/**
+ * Sanity checks/cleanups on HTML body of signature
+ */
+function rcmail_wash_html($html)
+{
+    // Add header with charset spec., washtml cannot work without that
+    $html = '<html><head>'
+        . '<meta http-equiv="Content-Type" content="text/html; charset='.RCMAIL_CHARSET.'" />'
+        . '</head><body>' . $html . '</body></html>';
+
+    // clean HTML with washhtml by Frederic Motte
+    $wash_opts = array(
+        'show_washed' => false,
+        'allow_remote' => 1,
+        'charset' => RCMAIL_CHARSET,
+        'html_elements' => array('body', 'link'),
+        'html_attribs' => array('rel', 'type'),
+    );
+
+    // initialize HTML washer
+    $washer = new rcube_washtml($wash_opts);
+
+    //$washer->add_callback('form', 'rcmail_washtml_callback');
+    //$washer->add_callback('style', 'rcmail_washtml_callback');
+
+    // Remove non-UTF8 characters (#1487813)
+    $html = rc_utf8_clean($html);
+
+    $html = $washer->wash($html);
+
+    // remove unwanted comments and tags (produced by washtml)
+    $html = preg_replace(array('/<!--[^>]+-->/', '/<\/?body>/'), '', $html);
+
+  return $html;
+}