summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--program/include/html.php2
-rw-r--r--program/steps/mail/func.inc17
2 files changed, 9 insertions, 10 deletions
diff --git a/program/include/html.php b/program/include/html.php
index e8c42c62b..87c9c1715 100644
--- a/program/include/html.php
+++ b/program/include/html.php
@@ -33,7 +33,7 @@ class html
protected $content;
public static $common_attrib = array('id','class','style','title','align');
- public static $containers = array('div','span','p','h1','h2','h3','form','textarea','table','tr','th','td');
+ public static $containers = array('div','span','p','h1','h2','h3','form','textarea','table','tr','th','td','style');
public static $lc_tags = true;
/**
diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc
index 6d23b6f8e..02bc4dce2 100644
--- a/program/steps/mail/func.inc
+++ b/program/steps/mail/func.inc
@@ -611,14 +611,13 @@ function rcmail_print_body($part, $p = array())
$wash_opts['html_elements'] = array('html','head','title','body');
}
- // allow CSS styles, will be sanitized by rcmail_washtml_callback()
- if ($p['safe']) {
- $wash_opts['html_elements'][] = 'style';
- }
-
$washer = new washtml($wash_opts);
$washer->add_callback('form', 'rcmail_washtml_callback');
- $washer->add_callback('style', 'rcmail_washtml_callback');
+
+ if ($p['safe']) { // allow CSS styles, will be sanitized by rcmail_washtml_callback()
+ $washer->add_callback('style', 'rcmail_washtml_callback');
+ }
+
$body = $washer->wash($html);
$REMOTE_OBJECTS = $washer->extlinks;
@@ -708,10 +707,10 @@ function rcmail_washtml_callback($tagname, $attrib, $content)
case 'style':
// decode all escaped entities and reduce to ascii strings
- $stripped = preg_replace('/[^a-zA-Z\(:]/', '', rcmail_xss_entitiy_decode($source));
+ $stripped = preg_replace('/[^a-zA-Z\(:]/', '', rcmail_xss_entitiy_decode($content));
- // now check for evli strings like expression, behavior or url()
- if (!preg_match('/expression|behavior|url\(|import/', $css)) {
+ // now check for evil strings like expression, behavior or url()
+ if (!preg_match('/expression|behavior|url\(|import/', $stripped)) {
$out = html::tag('style', array('type' => 'text/css'), $content);
break;
}