From 649cc19cfc0be218719e106680eba908bbb3d583 Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Mon, 17 Sep 2012 14:22:44 +0200 Subject: Fix HTML special characters handling in message list/header display (#1488523) --- program/include/rcube_utils.php | 3 --- 1 file changed, 3 deletions(-) (limited to 'program/include') diff --git a/program/include/rcube_utils.php b/program/include/rcube_utils.php index b278431a6..bf2b0db54 100644 --- a/program/include/rcube_utils.php +++ b/program/include/rcube_utils.php @@ -250,9 +250,6 @@ class rcube_utils $out = strtr($str, $encode_arr); - // avoid douple quotation of & - $out = preg_replace('/&([A-Za-z]{2,6}|#[0-9]{2,4});/', '&\\1;', $out); - return $newlines ? nl2br($out) : $out; } -- cgit v1.2.3 From d66e50d6b50523f68109c46b074b36fb161da552 Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Mon, 17 Sep 2012 15:01:34 +0200 Subject: Remove double-quotation prevention code for form elements --- program/include/html.php | 23 +++++++---------------- 1 file changed, 7 insertions(+), 16 deletions(-) (limited to 'program/include') diff --git a/program/include/html.php b/program/include/html.php index c6507f813..948794283 100644 --- a/program/include/html.php +++ b/program/include/html.php @@ -295,7 +295,7 @@ class html } } else { - $attrib_arr[] = $key . '="' . self::quote($value, true) . '"'; + $attrib_arr[] = $key . '="' . self::quote($value) . '"'; } } @@ -328,22 +328,13 @@ class html /** * Replacing specials characters in html attribute value * - * @param string $str Input string - * @param bool $validate Enables double quotation prevention + * @param string $str Input string * - * @return string The quoted string + * @return string The quoted string */ - public static function quote($str, $validate = false) + public static function quote($str) { - $str = htmlspecialchars($str, ENT_COMPAT, RCMAIL_CHARSET); - - // avoid douple quotation of & - // @TODO: get rid of it - if ($validate) { - $str = preg_replace('/&([A-Za-z]{2,6}|#[0-9]{2,4});/', '&\\1;', $str); - } - - return $str; + return htmlspecialchars($str, ENT_COMPAT, RCMAIL_CHARSET); } } @@ -559,7 +550,7 @@ class html_textarea extends html } if (!empty($value) && empty($this->attrib['is_escaped'])) { - $value = self::quote($value, true); + $value = self::quote($value); } return self::tag($this->tagname, $this->attrib, $value, @@ -635,7 +626,7 @@ class html_select extends html $option_content = $option['text']; if (empty($this->attrib['is_escaped'])) { - $option_content = self::quote($option_content, true); + $option_content = self::quote($option_content); } $this->content .= self::tag('option', $attr, $option_content); -- cgit v1.2.3 From 0f38fad2ef54cee36a686a4344f1b0bf28e445ef Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Mon, 17 Sep 2012 15:12:40 +0200 Subject: Replace Q() with html::quote() --- program/include/rcube_output_html.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'program/include') diff --git a/program/include/rcube_output_html.php b/program/include/rcube_output_html.php index 2743e7705..6138e2a30 100644 --- a/program/include/rcube_output_html.php +++ b/program/include/rcube_output_html.php @@ -527,7 +527,7 @@ class rcube_output_html extends rcube_output { $GLOBALS['__version'] = html::quote(RCMAIL_VERSION); $GLOBALS['__comm_path'] = html::quote($this->app->comm_path); - $GLOBALS['__skin_path'] = Q($this->config->get('skin_path')); + $GLOBALS['__skin_path'] = html::quote($this->config->get('skin_path')); return preg_replace_callback('/\$(__[a-z0-9_\-]+)/', array($this, 'globals_callback'), $input); -- cgit v1.2.3 From 1b9923208c64f4d3494e185ac3d249df5fbb8552 Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Fri, 21 Sep 2012 10:11:05 +0200 Subject: Re-fix HTML entities handling in addressbook names --- program/include/rcmail.php | 2 +- program/steps/addressbook/edit.inc | 7 ++++--- program/steps/addressbook/func.inc | 6 +++--- program/steps/addressbook/import.inc | 2 +- 4 files changed, 9 insertions(+), 8 deletions(-) (limited to 'program/include') diff --git a/program/include/rcmail.php b/program/include/rcmail.php index 5a9a1fa86..ee144faca 100644 --- a/program/include/rcmail.php +++ b/program/include/rcmail.php @@ -281,7 +281,7 @@ class rcmail extends rcube } $list[$id] = array( 'id' => $id, - 'name' => $prop['name'], + 'name' => html::quote($prop['name']), 'groups' => is_array($prop['groups']), 'readonly' => !$prop['writable'], 'hidden' => $prop['hidden'], diff --git a/program/steps/addressbook/edit.inc b/program/steps/addressbook/edit.inc index 90069a7eb..b216a7c70 100644 --- a/program/steps/addressbook/edit.inc +++ b/program/steps/addressbook/edit.inc @@ -244,11 +244,12 @@ function rcmail_source_selector($attrib) if (count($sources_list) < 2) { $source = $sources_list[$SOURCE_ID]; $hiddenfield = new html_hiddenfield(array('name' => '_source', 'value' => $SOURCE_ID)); - return html::span($attrib, Q($source['name']) . $hiddenfield->show()); + return html::span($attrib, $source['name'] . $hiddenfield->show()); } - $attrib['name'] = '_source'; - $attrib['onchange'] = JS_OBJECT_NAME . ".command('save', 'reload', this.form)"; + $attrib['name'] = '_source'; + $attrib['is_escaped'] = true; + $attrib['onchange'] = JS_OBJECT_NAME . ".command('save', 'reload', this.form)"; $select = new html_select($attrib); diff --git a/program/steps/addressbook/func.inc b/program/steps/addressbook/func.inc index 44d216c25..4ef4d1b51 100644 --- a/program/steps/addressbook/func.inc +++ b/program/steps/addressbook/func.inc @@ -178,7 +178,7 @@ function rcmail_set_sourcename($abook) if (!$name && $source == 0) { $name = rcube_label('personaladrbook'); } - $OUTPUT->set_env('sourcename', $name); + $OUTPUT->set_env('sourcename', html_entity_decode($name, ENT_COMPAT, 'UTF-8')); } } @@ -219,13 +219,13 @@ function rcmail_directory_list($attrib) if ($source['class_name']) $class_name .= ' ' . $source['class_name']; - $name = !empty($source['name']) ? html_entity_decode($source['name'], ENT_COMPAT, 'UTF-8') : $id; + $name = !empty($source['name']) ? $source['name'] : $id; $out .= sprintf($line_templ, html_identifier($id), $class_name, Q(rcmail_url(null, array('_source' => $id))), $source['id'], - $js_id, Q($name)); + $js_id, $name); $groupdata = array('out' => $out, 'jsdata' => $jsdata, 'source' => $id); if ($source['groups']) diff --git a/program/steps/addressbook/import.inc b/program/steps/addressbook/import.inc index 15e04b82a..fb2251f18 100644 --- a/program/steps/addressbook/import.inc +++ b/program/steps/addressbook/import.inc @@ -43,7 +43,7 @@ function rcmail_import_form($attrib) // addressbook selector if (count($writable_books) > 1) { - $select = new html_select(array('name' => '_target', 'id' => 'rcmimporttarget')); + $select = new html_select(array('name' => '_target', 'id' => 'rcmimporttarget', 'is_escaped' => true)); foreach ($writable_books as $book) $select->add($book['name'], $book['id']); -- cgit v1.2.3