githubFork/roundcubemail.git

			@@ -550,7 +550,7 @@
			* @param array CID map replaces (inline images)
			* @return string Clean HTML
			*/
			function rcmail_wash_html($html, $p = array(), $cid_replaces)
			function rcmail_wash_html($html, $p, $cid_replaces)
			{
			global $REMOTE_OBJECTS;

			@@ -559,7 +559,7 @@
			// special replacements (not properly handled by washtml class)
			$html_search = array(
			'/(<\/nobr>)(\s+)(<nobr>)/i', // space(s) between <NOBR>
			'/<title[^>]>.<\/title>/i', // PHP bug #32547 workaround: remove title tag
			'/<title[^>]>[^<]<\/title>/i', // PHP bug #32547 workaround: remove title tag
			'/^(\0\0\xFE\xFF\|\xFF\xFE\0\0\|\xFE\xFF\|\xFF\xFE\|\xEF\xBB\xBF)/', // byte-order mark (only outlook?)
			'/<html\s[^>]+>/i', // washtml/DOMDocument cannot handle xml namespaces
			);
			@@ -590,16 +590,16 @@
			$html = preg_replace_callback('/(<[\/]*)([^\s>]+)/', 'rcmail_html_tag_callback', $html);

			// charset was converted to UTF-8 in rcube_imap::get_message_part(),
			// -> change charset specification in HTML accordingly
			$charset_pattern = '(<meta\s+[^>]content=)[\'"]?(\w+\/\w+;\scharset=)([a-z0-9-_]+[\'"]?)';
			if (preg_match("/$charset_pattern/Ui", $html)) {
			$html = preg_replace("/$charset_pattern/i", '\\1"\\2'.RCMAIL_CHARSET.'"', $html);
			}
			else {
			// add meta content-type to malformed messages, washtml cannot work without that
			if (!preg_match('/<head[^>]>(.)<\/head>/Uims', $html))
			$html = '<head></head>'. $html;
			$html = substr_replace($html, '<meta http-equiv="Content-Type" content="text/html; charset='.RCMAIL_CHARSET.'" />', intval(stripos($html, '<head>')+6), 0);
			// change/add charset specification in HTML accordingly,
			// washtml cannot work without that
			$meta = '<meta http-equiv="Content-Type" content="text/html; charset='.RCMAIL_CHARSET.'" />';

			// remove old meta tag and add the new one, making sure
			// that it is placed in the head (#1488093)
			$html = preg_replace('/<meta[^>]+charset=[a-z0-9-_]+[^>]*>/Ui', '', $html);
			$html = preg_replace('/(<head[^>]*>)/Ui', '\\1'.$meta, $html, -1, $rcount);
			if (!$rcount) {
			$html = '<head>' . $meta . '</head>' . $html;
			}

			// turn relative into absolute urls
			@@ -638,6 +638,9 @@
			// allow CSS styles, will be sanitized by rcmail_washtml_callback()
			if (!$p['skip_washer_style_callback'])
			$washer->add_callback('style', 'rcmail_washtml_callback');

			// Remove non-UTF8 characters (#1487813)
			$html = rc_utf8_clean($html);

			$html = $washer->wash($html);
			$REMOTE_OBJECTS = $washer->extlinks;
			@@ -766,7 +769,7 @@

			// previous line is flowed?
			if (isset($body[$last]) && $body[$n]
			&& $last != $last_sig
			&& $last !== $last_sig
			&& $body[$last][strlen($body[$last])-1] == ' '
			) {
			$body[$last] .= $body[$n];
			@@ -818,7 +821,7 @@
			/**
			* Callback function for washtml cleaning class
			*/
			function rcmail_washtml_callback($tagname, $attrib, $content)
			function rcmail_washtml_callback($tagname, $attrib, $content, $washtml)
			{
			switch ($tagname) {
			case 'form':
			@@ -830,8 +833,11 @@
			$stripped = preg_replace('/[^a-zA-Z\(:;]/', '', rcmail_xss_entity_decode($content));

			// now check for evil strings like expression, behavior or url()
			if (!preg_match('/expression\|behavior\|url\(\|import[^a]/', $stripped)) {
			$out = html::tag('style', array('type' => 'text/css'), $content);
			if (!preg_match('/expression\|behavior\|javascript:\|import[^a]/i', $stripped)) {
			if (!$washtml->get_config('allow_remote') && stripos($stripped, 'url('))
			$washtml->extlinks = true;
			else
			$out = html::tag('style', array('type' => 'text/css'), $content);
			break;
			}

			@@ -1011,7 +1017,7 @@
			$body = rcmail_print_body($part, array('safe' => $safe_mode, 'plain' => !$CONFIG['prefer_html']));

			if ($part->ctype_secondary == 'html') {
			$body = rcmail_html4inline($body, $attrib['id'], 'rcmBody', $attrs);
			$body = rcmail_html4inline($body, $attrib['id'], 'rcmBody', $attrs, $safe_mode);
			$div_attr = array('class' => 'message-htmlpart');
			$style = array();

			@@ -1037,14 +1043,8 @@
			rcmail_plain_body(Q($MESSAGE->body, 'strict', false))));
			}

			$ctype_primary = strtolower($MESSAGE->structure->ctype_primary);
			$ctype_secondary = strtolower($MESSAGE->structure->ctype_secondary);

			// list images after mail body
			if ($CONFIG['inline_images']
			&& $ctype_primary == 'multipart'
			&& !empty($MESSAGE->attachments))
			{
			if ($CONFIG['inline_images'] && !empty($MESSAGE->attachments)) {
			foreach ($MESSAGE->attachments as $attach_prop) {
			// Content-Type: image/*...
			if (preg_match('/^image\//i', $attach_prop->mimetype) \|\|
			@@ -1055,7 +1055,7 @@
			) {
			$out .= html::tag('hr') . html::p(array('align' => "center"),
			html::img(array(
			'src' => $MESSAGE->get_part_url($attach_prop->mime_id),
			'src' => $MESSAGE->get_part_url($attach_prop->mime_id, true),
			'title' => $attach_prop->filename,
			'alt' => $attach_prop->filename,
			)));
			@@ -1091,7 +1091,7 @@
			/**
			* modify a HTML message that it can be displayed inside a HTML page
			*/
			function rcmail_html4inline($body, $container_id, $body_id='', &$attributes=null)
			function rcmail_html4inline($body, $container_id, $body_id='', &$attributes=null, $allow_remote=false)
			{
			$last_style_pos = 0;
			$body_lc = strtolower($body);
			@@ -1104,7 +1104,7 @@

			// replace all css definitions with #container [def]
			$styles = rcmail_mod_css_styles(
			substr($body, $pos, $pos2-$pos), $cont_id);
			substr($body, $pos, $pos2-$pos), $cont_id, $allow_remote);

			$body = substr($body, 0, $pos) . $styles . substr($body, $pos2);
			$body_lc = strtolower($body);
			@@ -1282,6 +1282,7 @@
			'href' => "#add",
			'onclick' => sprintf("return %s.command('add-contact','%s',this)", JS_OBJECT_NAME, urlencode($string)),
			'title' => rcube_label('addtoaddressbook'),
			'class' => 'rcmaddcontact',
			),
			html::img(array(
			'src' => $CONFIG['skin_path'] . $addicon,