From bd0551b22076b82a6d49e9f7a2b2e0c90a1b2326 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Fri, 05 Feb 2016 07:25:27 -0500
Subject: [PATCH] Secure also downloads of addressbook exports, managesieve script exports and Enigma keys exports
---
program/steps/utils/html2text.inc | 32 ++++++++++++++++++++------------
1 files changed, 20 insertions(+), 12 deletions(-)
diff --git a/program/steps/utils/html2text.inc b/program/steps/utils/html2text.inc
index ff2b40e..251eaf7 100644
--- a/program/steps/utils/html2text.inc
+++ b/program/steps/utils/html2text.inc
@@ -1,12 +1,15 @@
<?php
-/*
+/**
+-----------------------------------------------------------------------+
| program/steps/utils/html2text.inc |
| |
- | This file is part of the RoundCube Webmail client |
- | Copyright (C) 2005-2010, RoundCube Dev. - Switzerland |
- | Licensed under the GNU GPL |
+ | This file is part of the Roundcube Webmail client |
+ | Copyright (C) 2005-2015, The Roundcube Dev Team |
+ | |
+ | Licensed under the GNU General Public License version 3 or |
+ | any later version with exceptions for skins & plugins. |
+ | See the README file for a full license statement. |
| |
| PURPOSE: |
| Convert HTML message to plain text |
@@ -14,15 +17,20 @@
+-----------------------------------------------------------------------+
| Author: Thomas Bruederli <roundcube@gmail.com> |
+-----------------------------------------------------------------------+
-
- $Id$
-
*/
-$converter = new html2text($HTTP_RAW_POST_DATA);
+$html = stream_get_contents(fopen('php://input', 'r'));
-header('Content-Type: text/plain; charset=UTF-8');
-print trim($converter->get_text());
+// strip slashes if magic_quotes enabled
+if (get_magic_quotes_gpc() || get_magic_quotes_runtime()) {
+ $html = stripslashes($html);
+}
+
+$params['links'] = (bool) rcube_utils::get_input_value('_do_links', rcube_utils::INPUT_GET);
+$params['width'] = (int) rcube_utils::get_input_value('_width', rcube_utils::INPUT_GET);
+
+$text = $RCMAIL->html2text($html, $params);
+
+header('Content-Type: text/plain; charset=' . RCUBE_CHARSET);
+print $text;
exit;
-
-?>
--
Gitblit v1.9.1