diff options
Diffstat (limited to 'program/steps')
| -rw-r--r-- | program/steps/mail/compose.inc | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/program/steps/mail/compose.inc b/program/steps/mail/compose.inc index 2330bc040..590d9c27f 100644 --- a/program/steps/mail/compose.inc +++ b/program/steps/mail/compose.inc @@ -1000,10 +1000,14 @@ function rcmail_create_draft_body($body, $bodyIsHtml) && count($MESSAGE->mime_parts) > 0) { $cid_map = rcmail_write_compose_attachments($MESSAGE, $bodyIsHtml); + } + + // clean up html tags - XSS prevention (#1489251) + $body = rcmail_wash_html($body, array('safe' => 1), $cid_map); - // replace cid with href in inline images links - if ($cid_map) - $body = str_replace(array_keys($cid_map), array_values($cid_map), $body); + // replace cid with href in inline images links + if ($cid_map) { + $body = str_replace(array_keys($cid_map), array_values($cid_map), $body); } return $body; |