From f06aa8058b7e32ba32d4551074b6e0b8a300f751 Mon Sep 17 00:00:00 2001
From: Thomas Bruederli <thomas@roundcube.net>
Date: Mon, 21 Oct 2013 15:02:40 -0400
Subject: [PATCH] Bump version after security fix
---
program/include/rcube_string_replacer.php | 29 ++++++++++++++++++-----------
1 files changed, 18 insertions(+), 11 deletions(-)
diff --git a/program/include/rcube_string_replacer.php b/program/include/rcube_string_replacer.php
index e0a7364..b3d29eb 100644
--- a/program/include/rcube_string_replacer.php
+++ b/program/include/rcube_string_replacer.php
@@ -5,8 +5,11 @@
| program/include/rcube_string_replacer.php |
| |
| This file is part of the Roundcube Webmail client |
- | Copyright (C) 2009, Roundcube Dev. - Switzerland |
- | Licensed under the GNU GPL |
+ | Copyright (C) 2009, The Roundcube Dev Team |
+ | |
+ | Licensed under the GNU General Public License version 3 or |
+ | any later version with exceptions for skins & plugins. |
+ | See the README file for a full license statement. |
| |
| PURPOSE: |
| Handle string replacements based on preg_replace_callback |
@@ -36,14 +39,16 @@
function __construct()
{
// Simplified domain expression for UTF8 characters handling
- $utf_domain = '[^?&@"\'\\/()\s\r\t\n]+\\.[a-z]{2,5}';
- $url = '[a-z0-9%=#@+?.:;&\\/_~\\[\\]-]+';
+ // Support unicode/punycode in top-level domain part
+ $utf_domain = '[^?&@"\'\\/()\s\r\t\n]+\\.([^\\x00-\\x2f\\x3b-\\x40\\x5b-\\x60\\x7b-\\x7f]{2,}|xn--[a-z0-9]{2,})';
+ $url1 = '.:;,';
+ $url2 = 'a-z0-9%=#@+?!&\\/_~\\[\\]{}-';
- $this->link_pattern = "/([\w]+:\/\/|\Wwww\.)($utf_domain($url)?)/i";
+ $this->link_pattern = "/([\w]+:\/\/|\Wwww\.)($utf_domain([$url1]?[$url2]+)*)/i";
$this->mailto_pattern = "/("
."[-\w!\#\$%&\'*+~\/^`|{}=]+(?:\.[-\w!\#\$%&\'*+~\/^`|{}=]+)*" // local-part
."@$utf_domain" // domain-part
- ."(\?$url)?" // e.g. ?subject=test...
+ ."(\?[$url1$url2]+)?" // e.g. ?subject=test...
.")/i";
}
@@ -88,11 +93,13 @@
$prefix = $m[1];
}
- $suffix = $this->parse_url_brackets($url);
- $i = $this->add($prefix . html::a(array(
- 'href' => $url_prefix . $url,
- 'target' => '_blank'
- ), Q($url)) . $suffix);
+ if ($url) {
+ $suffix = $this->parse_url_brackets($url);
+ $i = $this->add($prefix . html::a(array(
+ 'href' => $url_prefix . $url,
+ 'target' => '_blank'
+ ), Q($url)) . $suffix);
+ }
// Return valid link for recognized schemes, otherwise, return the unmodified string for unrecognized schemes.
return $i >= 0 ? $this->get_replacement($i) : $matches[0];
--
Gitblit v1.9.1