diff options
| -rw-r--r-- | program/include/html.php | 2 | ||||
| -rw-r--r-- | program/steps/mail/func.inc | 17 |
2 files changed, 9 insertions, 10 deletions
diff --git a/program/include/html.php b/program/include/html.php index e8c42c62b..87c9c1715 100644 --- a/program/include/html.php +++ b/program/include/html.php @@ -33,7 +33,7 @@ class html protected $content; public static $common_attrib = array('id','class','style','title','align'); - public static $containers = array('div','span','p','h1','h2','h3','form','textarea','table','tr','th','td'); + public static $containers = array('div','span','p','h1','h2','h3','form','textarea','table','tr','th','td','style'); public static $lc_tags = true; /** diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc index 6d23b6f8e..02bc4dce2 100644 --- a/program/steps/mail/func.inc +++ b/program/steps/mail/func.inc @@ -611,14 +611,13 @@ function rcmail_print_body($part, $p = array()) $wash_opts['html_elements'] = array('html','head','title','body'); } - // allow CSS styles, will be sanitized by rcmail_washtml_callback() - if ($p['safe']) { - $wash_opts['html_elements'][] = 'style'; - } - $washer = new washtml($wash_opts); $washer->add_callback('form', 'rcmail_washtml_callback'); - $washer->add_callback('style', 'rcmail_washtml_callback'); + + if ($p['safe']) { // allow CSS styles, will be sanitized by rcmail_washtml_callback() + $washer->add_callback('style', 'rcmail_washtml_callback'); + } + $body = $washer->wash($html); $REMOTE_OBJECTS = $washer->extlinks; @@ -708,10 +707,10 @@ function rcmail_washtml_callback($tagname, $attrib, $content) case 'style': // decode all escaped entities and reduce to ascii strings - $stripped = preg_replace('/[^a-zA-Z\(:]/', '', rcmail_xss_entitiy_decode($source)); + $stripped = preg_replace('/[^a-zA-Z\(:]/', '', rcmail_xss_entitiy_decode($content)); - // now check for evli strings like expression, behavior or url() - if (!preg_match('/expression|behavior|url\(|import/', $css)) { + // now check for evil strings like expression, behavior or url() + if (!preg_match('/expression|behavior|url\(|import/', $stripped)) { $out = html::tag('style', array('type' => 'text/css'), $content); break; } |