From d15163ab6ecabde9d12e8674bee37cbe562bd850 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Wed, 14 Nov 2012 13:29:58 +0100
Subject: Fix XSS vulnerability in handling of text/enriched messages
 (#1488806)

---
 program/steps/mail/func.inc | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'program')

diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc
index 5e24a4311..3668cd7b2 100644
--- a/program/steps/mail/func.inc
+++ b/program/steps/mail/func.inc
@@ -753,7 +753,9 @@ function rcmail_print_body($part, $p = array())
   else if ($data['type'] == 'enriched') {
     $part->ctype_secondary = 'html';
     require_once(INSTALL_PATH . 'program/lib/enriched.inc');
-    $body = Q(enriched_to_html($data['body']), 'show');
+    $body = enriched_to_html($data['body']);
+    $body = rcmail_wash_html($body, $data, $part->replaces);
+    $part->ctype_secondary = 'html';
   }
   else {
     // assert plaintext
-- 
cgit v1.2.3