From 276ea5fcaec2e9fd79a5c1d90ab78104252b35b5 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Thu, 01 Aug 2013 08:54:17 -0400
Subject: [PATCH] Fix XSS vulnerability when editing a message "as new" or draft (#1489251) - added HTML content "washing"
---
CHANGELOG | 1 +
program/steps/mail/compose.inc | 10 +++++++---
2 files changed, 8 insertions(+), 3 deletions(-)
diff --git a/CHANGELOG b/CHANGELOG
index 8d163de..1729d36 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,7 @@
CHANGELOG Roundcube Webmail
===========================
+- Fix XSS vulnerability when editing a message "as new" or draft (#1489251)
- Fix rewrite rule in .htaccess (#1489240)
- Fix detecting Turkish language in ISO-8859-9 encoding (#1489252)
- Fix identity-selection using Return-Path headers (#1489241)
diff --git a/program/steps/mail/compose.inc b/program/steps/mail/compose.inc
index 73a7f34..5d588ab 100644
--- a/program/steps/mail/compose.inc
+++ b/program/steps/mail/compose.inc
@@ -980,10 +980,14 @@
&& count($MESSAGE->mime_parts) > 0)
{
$cid_map = rcmail_write_compose_attachments($MESSAGE, $bodyIsHtml);
+ }
- // replace cid with href in inline images links
- if ($cid_map)
- $body = str_replace(array_keys($cid_map), array_values($cid_map), $body);
+ // clean up html tags - XSS prevention (#1489251)
+ $body = rcmail_wash_html($body, array('safe' => 1), $cid_map);
+
+ // replace cid with href in inline images links
+ if ($cid_map) {
+ $body = str_replace(array_keys($cid_map), array_values($cid_map), $body);
}
return $body;
--
Gitblit v1.9.1