diff options
| -rw-r--r-- | CHANGELOG | 1 | ||||
| -rw-r--r-- | program/steps/mail/func.inc | 2 |
2 files changed, 2 insertions, 1 deletions
@@ -1,6 +1,7 @@ CHANGELOG Roundcube Webmail =========================== +- Fix XSS vulnerability in message subject handling using Larry skin (#1488519) - Fix handling of links with various URI schemes e.g. "skype:" (#1488106) - Fix handling of links inside PRE elements on html to text conversion - Fix indexing of links on html to text conversion diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc index 1e5dbda19..7417c6ba3 100644 --- a/program/steps/mail/func.inc +++ b/program/steps/mail/func.inc @@ -947,7 +947,7 @@ function rcmail_message_headers($attrib, $headers=NULL) // single header value is requested if (!empty($attrib['valueof'])) - return Q($plugin['output'][$attrib['valueof']]['value'], ($hkey == 'subject' ? 'strict' : 'show')); + return Q($plugin['output'][$attrib['valueof']]['value'], ($attrib['valueof'] == 'subject' ? 'strict' : 'show')); // compose html table $table = new html_table(array('cols' => 2)); |