Request 2748 (accepted)

roundcubemail.spec Changed

debian.changelog Changed

roundcubemail-1.4.4.14.tar.gz/CHANGELOG -> roundcubemail-1.4.7.tar.gz/CHANGELOG Changed

@@ -1,6 +1,22 @@
 CHANGELOG Roundcube Webmail
 ===========================
 
+RELEASE 1.4.7
+-------------
+- Fix bug where subfolders of special folders could have been duplicated on folder list
+- Increase maximum size of contact jobtitle and department fields to 128 characters
+- Fix missing newline after the logged line when writing to stdout (#7418)
+- Elastic: Fix context menu (paste) on the recipient input (#7431)
+- Fix problem with forwarding inline images attached to messages with no HTML part (#7414)
+- Fix problem with handling attached images with same name when using database_attachments/redundant_attachments (#7455)
+- Security: Fix cross-site scripting (XSS) via HTML messages with malicious svg/namespace
+
+RELEASE 1.4.6
+-------------
+- Installer: Fix regression in SMTP test section (#7417)
+
+RELEASE 1.4.5
+-------------
 - Fix bug in extracting required plugins from composer.json that led to spurious error in log (#7364)
 - Fix so the database setup description is compatible with MySQL 8 (#7340)
 - Markasjunk: Fix regression in jsevent driver (#7361)
@@ -9,6 +25,14 @@
 - Password: Fix issue with Modoboa driver (#7372)
 - Mailvelope: Use sender's address to find pubkeys to check signatures (#7348)
 - Mailvelope: Fix Encrypt button hidden in Elastic (#7353)
+- Fix PHP warning: count(): Parameter must be an array or an object... in ID command handler (#7392)
+- Fix error when user-configured skin does not exist anymore (#7271)
+- Elastic: Fix aspect ratio of a contact photo in mail preview (#7339)
+- Fix bug where PDF attachments marked as inline could have not been attached on mail forward (#7382)
+- Security: Fix a couple of XSS issues in Installer (#7406)
+- Security: Fix XSS issue in template object 'username' (#7406)
+- Security: Better fix for CVE-2020-12641
+- Security: Fix cross-site scripting (XSS) via malicious XML attachment
 
 RELEASE 1.4.4
 -------------
@@ -36,10 +60,10 @@
 - Make install-jsdeps.sh script working without the 'file' program installed (#7325)
 - Fix performance issue of parsing big HTML messages by disabling HTML5 parser for these (#7331)
 - Fix so Print button for PDF attachments works on Firefox >= 75 (#5125)
-- Security: Fix XSS issue in handling of CDATA in HTML messages
-- Security: Fix remote code execution via crafted 'im_convert_path' or 'im_identify_path' settings
-- Security: Fix local file inclusion (and code execution) via crafted 'plugins' option
-- Security: Fix CSRF bypass that could be used to log out an authenticated user (#7302)
+- Security: Fix XSS issue in handling of CDATA in HTML messages [CVE-2020-12625]
+- Security: Fix remote code execution via crafted 'im_convert_path' or 'im_identify_path' settings [CVE-2020-12641]
+- Security: Fix local file inclusion (and code execution) via crafted 'plugins' option [CVE-2020-12640]
+- Security: Fix CSRF bypass that could be used to log out an authenticated user [CVE-2020-12626] (#7302)
 
 RELEASE 1.4.3
 -------------

roundcubemail-1.4.4.14.tar.gz/INSTALL -> roundcubemail-1.4.7.tar.gz/INSTALL Changed

roundcubemail-1.4.4.14.tar.gz/config/defaults.inc.php -> roundcubemail-1.4.7.tar.gz/config/defaults.inc.php Changed

roundcubemail-1.4.4.14.tar.gz/index.php -> roundcubemail-1.4.7.tar.gz/index.php Changed

roundcubemail-1.4.4.14.tar.gz/installer/index.php -> roundcubemail-1.4.7.tar.gz/installer/index.php Changed

roundcubemail-1.4.4.14.tar.gz/installer/test.php -> roundcubemail-1.4.7.tar.gz/installer/test.php Changed

@@ -139,7 +139,7 @@
         else {
             $RCI->fail('DSN (write)', $db_error_msg);
             echo '<p class="hint">Make sure that the configured database exists and that the user has write privileges<br />';
-            echo 'DSN: ' . $RCI->config['db_dsnw'] . '</p>';
+            echo 'DSN: ' . rcube::Q($RCI->config['db_dsnw']) . '</p>';
         }
     }
     else {
@@ -270,10 +270,16 @@
     $user_field = new html_inputfield(array('name' => '_smtp_user', 'id' => 'smtp_user'));
     $user = $user_field->show($_POST['_smtp_user']);
 }
+else {
+    $user = html::quote($user);
+}
 if ($pass == '%p') {
     $pass_field = new html_passwordfield(array('name' => '_smtp_pass', 'id' => 'smtp_pass'));
     $pass = $pass_field->show();
 }
+else {
+    $pass = html::quote($pass);
+}
 
 ?>
 
@@ -284,11 +290,11 @@
 <tbody>
   <tr>
     <td><label for="smtp_server">Server</label></td>
-    <td><?php echo rcube_utils::parse_host($RCI->getprop('smtp_server', 'localhost')); ?></td>
+    <td><?php echo rcube::Q(rcube_utils::parse_host($RCI->getprop('smtp_server', 'localhost'))); ?></td>
   </tr>
   <tr>
     <td><label for="smtp_port">Port</label></td>
-    <td><?php echo $RCI->getprop('smtp_port'); ?></td>
+    <td><?php echo rcube::Q($RCI->getprop('smtp_port')); ?></td>
   </tr>
   <tr>
     <td><label for="smtp_user">Username</label></td>

roundcubemail-1.4.4.14.tar.gz/plugins/database_attachments/database_attachments.php -> roundcubemail-1.4.7.tar.gz/plugins/database_attachments/database_attachments.php Changed

roundcubemail-1.4.4.14.tar.gz/plugins/redundant_attachments/redundant_attachments.php -> roundcubemail-1.4.7.tar.gz/plugins/redundant_attachments/redundant_attachments.php Changed

roundcubemail-1.4.4.14.tar.gz/program/include/iniset.php -> roundcubemail-1.4.7.tar.gz/program/include/iniset.php Changed

roundcubemail-1.4.4.14.tar.gz/program/include/rcmail_output_html.php -> roundcubemail-1.4.7.tar.gz/program/include/rcmail_output_html.php Changed

roundcubemail-1.4.4.14.tar.gz/program/lib/Roundcube/bootstrap.php -> roundcubemail-1.4.7.tar.gz/program/lib/Roundcube/bootstrap.php Changed

roundcubemail-1.4.4.14.tar.gz/program/lib/Roundcube/rcube.php -> roundcubemail-1.4.7.tar.gz/program/lib/Roundcube/rcube.php Changed

roundcubemail-1.4.4.14.tar.gz/program/lib/Roundcube/rcube_config.php -> roundcubemail-1.4.7.tar.gz/program/lib/Roundcube/rcube_config.php Changed

@@ -27,6 +27,8 @@
 {
     const DEFAULT_SKIN = 'elastic';
 
+    public $system_skin = 'elastic';
+
     private $env       = '';
     private $paths     = array();
     private $prop      = array();
@@ -231,6 +233,8 @@
             $this->prop['skin'] = self::DEFAULT_SKIN;
         }
 
+        $this->system_skin = $this->prop['skin'];
+
         // fix paths
         foreach (array('log_dir' => 'logs', 'temp_dir' => 'temp') as $key => $dir) {
             foreach (array($this->prop[$key], '../' . $this->prop[$key], RCUBE_INSTALL_PATH . $dir) as $path) {
@@ -391,7 +395,7 @@
         }
         else if ($name == 'client_mimetypes') {
             if (!$result && !$def) {
-                $result = 'text/plain,text/html,text/xml'
+                $result = 'text/plain,text/html'
                     . ',image/jpeg,image/gif,image/png,image/bmp,image/tiff,image/webp'
                     . ',application/x-javascript,application/pdf,application/x-shockwave-flash';
             }
@@ -452,7 +456,7 @@
         }
 
         if ($prefs['skin'] == 'default') {
-            $prefs['skin'] = self::DEFAULT_SKIN;
+            $prefs['skin'] = $this->system_skin;
         }
 
         $skins_allowed = $this->get('skins_allowed');

roundcubemail-1.4.4.14.tar.gz/program/lib/Roundcube/rcube_image.php -> roundcubemail-1.4.7.tar.gz/program/lib/Roundcube/rcube_image.php Changed

@@ -99,7 +99,7 @@
     {
         $result  = false;
         $rcube   = rcube::get_instance();
-        $convert = $rcube->config->get('im_convert_path', false);
+        $convert = self::getCommand('im_convert_path');
         $props   = $this->props();
 
         if (empty($props)) {
@@ -158,7 +158,7 @@
                             'size'    => $width . 'x' . $height,
                         );
 
-                        $result = rcube::exec(escapeshellcmd($convert)
+                        $result = rcube::exec($convert
                             . ' 2>&1 -flatten -auto-orient -colorspace sRGB -strip'
                             . ' -quality {quality} -resize {size} {intype}:{in} {type}:{out}', $p);
                     }
@@ -307,7 +307,7 @@
     public function convert($type, $filename = null)
     {
         $rcube   = rcube::get_instance();
-        $convert = $rcube->config->get('im_convert_path', false);
+        $convert = self::getCommand('im_convert_path');
 
         if (!$filename) {
             $filename = $this->image_file;
@@ -324,8 +324,7 @@
             $p['out']  = $filename;
             $p['type'] = self::$extensions[$type];
 
-            $result = rcube::exec(escapeshellcmd($convert)
-                . ' 2>&1 -colorspace sRGB -strip -flatten -quality 75 {in} {type}:{out}', $p);
+            $result = rcube::exec($convert . ' 2>&1 -colorspace sRGB -strip -flatten -quality 75 {in} {type}:{out}', $p);
 
             if ($result === '') {
                 chmod($filename, 0600);
@@ -408,7 +407,7 @@
         $rcube = rcube::get_instance();
 
         // @TODO: check if specified mimetype is really supported
-        return class_exists('Imagick', false) || $rcube->config->get('im_convert_path');
+        return class_exists('Imagick', false) || self::getCommand('im_convert_path');
     }
 
     /**
@@ -419,9 +418,9 @@
         $rcube = rcube::get_instance();
 
         // use ImageMagick in command line
-        if ($cmd = $rcube->config->get('im_identify_path')) {
+        if ($cmd = self::getCommand('im_identify_path')) {
             $args = array('in' => $this->image_file, 'format' => "%m %[fx:w] %[fx:h]");
-            $id   = rcube::exec(escapeshellcmd($cmd) . ' 2>/dev/null -format {format} {in}', $args);
+            $id   = rcube::exec($cmd . ' 2>/dev/null -format {format} {in}', $args);
 
             if ($id) {
                 return explode(' ', strtolower($id));
@@ -464,4 +463,39 @@
         $size = $props['width'] * $props['height'] * $multip;
         return rcube_utils::mem_check($size);
     }
+
+    /**
+     * Get the configured command and make sure it is safe to use.
+     * We cannot trust configuration, and escapeshellcmd() is useless.
+     *
+     * @param string $opt_name Configuration option name
+     *
+     * @return bool|string The command or False if not set or invalid
+     */
+    private static function getCommand($opt_name)
+    {
+        static $error = [];
+
+        $cmd = rcube::get_instance()->config->get($opt_name);
+
+        if (empty($cmd)) {
+            return false;
+        }
+
+        if (preg_match('/^(convert|identify)(\.exe)?$/i', $cmd)) {
+            return $cmd;
+        }
+
+        // Executable must exist, also disallow network shares on Windows
+        if ($cmd[0] != "\\" && file_exists($cmd)) {
+            return $cmd;
+        }
+
+        if (empty($error[$opt_name])) {
+            rcube::raise_error("Invalid $opt_name: $cmd", true, false);
+            $error[$opt_name] = true;
+        }
+
+        return false;
+    }
 }

roundcubemail-1.4.4.14.tar.gz/program/lib/Roundcube/rcube_imap.php -> roundcubemail-1.4.7.tar.gz/program/lib/Roundcube/rcube_imap.php Changed

roundcubemail-1.4.4.14.tar.gz/program/lib/Roundcube/rcube_imap_generic.php -> roundcubemail-1.4.7.tar.gz/program/lib/Roundcube/rcube_imap_generic.php Changed

roundcubemail-1.4.4.14.tar.gz/program/lib/Roundcube/rcube_washtml.php -> roundcubemail-1.4.7.tar.gz/program/lib/Roundcube/rcube_washtml.php Changed

@@ -521,7 +521,10 @@
                         $xpath = new DOMXPath($node->ownerDocument);
                         foreach ($xpath->query('namespace::*') as $ns) {
                             if ($ns->nodeName != 'xmlns:xml') {
-                                $dump .= ' ' . $ns->nodeName . '="' . $ns->nodeValue . '"';
+                                $dump .= sprintf(' %s="%s"',
+                                    $ns->nodeName,
+                                    htmlspecialchars($ns->nodeValue, ENT_QUOTES, $this->config['charset'])
+                                );
                             }
                         }
                     }
@@ -588,7 +591,7 @@
         $this->max_nesting_level = (int) @ini_get('xdebug.max_nesting_level');
 
         // SVG need to be parsed as XML
-        $this->is_xml = stripos($html, '<html') === false && stripos($html, '<svg') !== false;
+        $this->is_xml = !preg_match('/<(html|head|body)/i', $html) && stripos($html, '<svg') !== false;
         $method       = $this->is_xml ? 'loadXML' : 'loadHTML';
 
         // DOMDocument does not support HTML5, try Masterminds parser if available

roundcubemail-1.4.4.14.tar.gz/program/steps/addressbook/func.inc -> roundcubemail-1.4.7.tar.gz/program/steps/addressbook/func.inc Changed

@@ -29,9 +29,9 @@
     'prefix'       => array('type' => 'text', 'size' => 8,  'maxlength' => 20, 'limit' => 1, 'label' => $RCMAIL->gettext('nameprefix'), 'category' => 'main'),
     'suffix'       => array('type' => 'text', 'size' => 8,  'maxlength' => 20, 'limit' => 1, 'label' => $RCMAIL->gettext('namesuffix'), 'category' => 'main'),
     'nickname'     => array('type' => 'text', 'size' => 40, 'maxlength' => 50, 'limit' => 1, 'label' => $RCMAIL->gettext('nickname'), 'category' => 'main'),
-    'jobtitle'     => array('type' => 'text', 'size' => 40, 'maxlength' => 50, 'limit' => 1, 'label' => $RCMAIL->gettext('jobtitle'), 'category' => 'main'),
+    'jobtitle'     => array('type' => 'text', 'size' => 40, 'maxlength' => 128, 'limit' => 1, 'label' => $RCMAIL->gettext('jobtitle'), 'category' => 'main'),
     'organization' => array('type' => 'text', 'size' => 40, 'maxlength' => 128, 'limit' => 1, 'label' => $RCMAIL->gettext('organization'), 'category' => 'main'),
-    'department'   => array('type' => 'text', 'size' => 40, 'maxlength' => 50, 'limit' => 1, 'label' => $RCMAIL->gettext('department'), 'category' => 'main'),
+    'department'   => array('type' => 'text', 'size' => 40, 'maxlength' => 128, 'limit' => 1, 'label' => $RCMAIL->gettext('department'), 'category' => 'main'),
     'gender'       => array('type' => 'select', 'limit' => 1, 'label' => $RCMAIL->gettext('gender'), 'options' => array('male' => $RCMAIL->gettext('male'), 'female' => $RCMAIL->gettext('female')), 'category' => 'personal'),
     'maidenname'   => array('type' => 'text', 'size' => 40, 'maxlength' => 50, 'limit' => 1, 'label' => $RCMAIL->gettext('maidenname'), 'category' => 'personal'),
     'phone'        => array('type' => 'text', 'size' => 40, 'maxlength' => 20, 'label' => $RCMAIL->gettext('phone'), 'subtypes' => array('home','home2','work','work2','mobile','main','homefax','workfax','car','pager','video','assistant','other'), 'category' => 'main'),

roundcubemail-1.4.4.14.tar.gz/program/steps/mail/compose.inc -> roundcubemail-1.4.7.tar.gz/program/steps/mail/compose.inc Changed

@@ -953,13 +953,15 @@
         $loaded_attachments[$attachment['name'] . $attachment['mimetype']] = $attachment;
     }
 
+    $has_html = $message->has_html_part();
+
     foreach ((array) $message->mime_parts() as $pid => $part) {
         if ($part->mimetype == 'message/rfc822') {
             $messages[] = $part->mime_id;
         }
 
         if (
-            $part->disposition == 'attachments'
+            $part->disposition == 'attachment'
             || ($part->disposition == 'inline' && $bodyIsHtml)
             || $part->filename
             || $part->mimetype == 'message/rfc822'
@@ -988,8 +990,10 @@
 
             $replace = null;
 
-            // skip inline images when not used in the body
-            if ($part->disposition == 'inline') {
+            // Skip inline images when not used in the body
+            // Note: Apple Mail sends PDF files marked as inline (#7382)
+            // Note: Apple clients send inline images even if there's no HTML body (#7414)
+            if ($has_html && $part->disposition == 'inline' && $part->mimetype != 'application/pdf') {
                 if (!$bodyIsHtml) {
                     continue;
                 }

roundcubemail-1.4.4.14.tar.gz/program/steps/mail/func.inc -> roundcubemail-1.4.7.tar.gz/program/steps/mail/func.inc Changed

roundcubemail-1.4.4.14.tar.gz/program/steps/mail/show.inc -> roundcubemail-1.4.7.tar.gz/program/steps/mail/show.inc Changed

@@ -77,7 +77,7 @@
     $OUTPUT->set_env('permaurl', $RCMAIL->url(array('_action' => 'show', '_uid' => $msg_id, '_mbox' => $mbox_name)));
     $OUTPUT->set_env('has_writeable_addressbook', $_SESSION['writeable_abook']);
     $OUTPUT->set_env('delimiter', $RCMAIL->storage->get_hierarchy_delimiter());
-    $OUTPUT->set_env('mimetypes', rcmail_supported_mimetypes());
+    $OUTPUT->set_env('mimetypes', $CLIENT_MIMETYPES = rcmail_supported_mimetypes());
 
     if ($MESSAGE->headers->get('list-post', false)) {
         $OUTPUT->set_env('list_post', true);
@@ -596,7 +596,7 @@
  */
 function rcmail_message_body($attrib)
 {
-    global $OUTPUT, $MESSAGE, $RCMAIL, $REMOTE_OBJECTS;
+    global $OUTPUT, $MESSAGE, $RCMAIL, $REMOTE_OBJECTS, $CLIENT_MIMETYPES;
 
     if (!is_array($MESSAGE->parts) && empty($MESSAGE->body)) {
         return '';
@@ -707,10 +707,8 @@
     // list images after mail body
     if ($RCMAIL->config->get('inline_images', true) && !empty($MESSAGE->attachments)) {
         $thumbnail_size   = $RCMAIL->config->get('image_thumbnail_size', 240);
-        $client_mimetypes = (array)$RCMAIL->config->get('client_mimetypes');
-
-        $show_label     = rcube::Q($RCMAIL->gettext('showattachment'));
-        $download_label = rcube::Q($RCMAIL->gettext('download'));
+        $show_label       = rcube::Q($RCMAIL->gettext('showattachment'));
+        $download_label   = rcube::Q($RCMAIL->gettext('download'));
 
         foreach ($MESSAGE->attachments as $attach_prop) {
             // skip inline images
@@ -722,7 +720,7 @@
             if ($mimetype = rcmail_part_image_type($attach_prop)) {
                 // display thumbnails
                 if ($thumbnail_size) {
-                    $supported = in_array($mimetype, $client_mimetypes);
+                    $supported = in_array($mimetype, $CLIENT_MIMETYPES);
                     $show_link_attr = array(
                         'href'    => $MESSAGE->get_part_url($attach_prop->mime_id, false),
                         'onclick' => sprintf(

roundcubemail-1.4.4.14.tar.gz/public_html/index.php -> roundcubemail-1.4.7.tar.gz/public_html/index.php Changed

roundcubemail-1.4.4.14.tar.gz/skins/elastic/styles/styles.less -> roundcubemail-1.4.7.tar.gz/skins/elastic/styles/styles.less Changed

roundcubemail-1.4.4.14.tar.gz/skins/elastic/styles/widgets/forms.less -> roundcubemail-1.4.7.tar.gz/skins/elastic/styles/widgets/forms.less Changed

roundcubemail-1.4.4.14.tar.gz/skins/elastic/ui.js -> roundcubemail-1.4.7.tar.gz/skins/elastic/ui.js Changed

@@ -3119,9 +3119,6 @@
     function recipient_input(obj)
     {
         var list, input, selection = '',
-            input_len_update = function() {
-                input.css('width', Math.max(5, input.val().length * 15 + 10));
-            },
             apply_func = function() {
                 // update the original input
                 $(obj).val(list.text() + input.val());
@@ -3167,7 +3164,6 @@
 
                 input.val(result.text);
                 apply_func();
-                input_len_update();
 
                 return result.recipients.length > 0;
             },
@@ -3209,20 +3205,17 @@
                         return false;
                     }
                 }
-
-                input_len_update();
             };
 
         // Create the input element and "editable" area
         input = $('<input>').attr({type: 'text', tabindex: $(obj).attr('tabindex')})
             .on('paste change', parse_func)
-            .on('input', input_len_update) // only to fix input length after paste
             .on('keydown', keydown_func)
             .on('blur', function() { list.removeClass('focus'); })
             .on('focus mousedown', function() { list.addClass('focus'); });
 
         list = $('<ul>').addClass('form-control recipient-input ac-input rounded-left')
-            .append($('<li>').append(input))
+            .append($('<li class="input">').append(input))
             // "selection" hack to allow text selection in the recipient box or multiple boxes (#7129)
             .on('mouseup', function () { selection = window.getSelection().toString(); })
             .on('click', function() { if (!selection.length) input.focus(); });

roundcubemail-1.4.4.14.tar.gz/tests/Framework/Imap.php -> roundcubemail-1.4.7.tar.gz/tests/Framework/Imap.php Changed

@@ -17,4 +17,65 @@
 
         $this->assertInstanceOf('rcube_imap', $object, "Class constructor");
     }
+
+    /**
+     * Folder sorting
+     */
+    function test_sort_folder_list()
+    {
+        $_SESSION['imap_delimiter'] = '.';
+        $_SESSION['imap_namespace'] = [
+            'personal' => null,
+            'other' => [['Other Users.', '.']],
+            'shared' => [['Shared.', '.']],
+        ];
+
+        foreach (array('drafts', 'sent', 'junk', 'trash') as $mbox) {
+            rcube::get_instance()->config->set("$mbox_mbox", ucfirst($mbox));
+        }
+
+        $object = new rcube_imap;
+
+        $result = $object->sort_folder_list([]);
+        $this->assertSame([], $result);
+
+        $result = $object->sort_folder_list(['B', 'A']);
+        $this->assertSame(['A', 'B'], $result);
+
+        $folders = [
+            'Trash',
+            'Sent',
+            'ABC',
+            'Drafts',
+            'INBOX.Trash',
+            'INBOX.Junk',
+            'INBOX.Sent',
+            'INBOX.Drafts',
+            'Shared.Test1',
+            'Other Users.Test2',
+            'Junk',
+            'INBOX',
+            'DEF',
+        ];
+
+        $expected = [
+            'INBOX',
+            'INBOX.Drafts',
+            'INBOX.Junk',
+            'INBOX.Sent',
+            'INBOX.Trash',
+            'Drafts',
+            'Sent',
+            'Junk',
+            'Trash',
+            'ABC',
+            'DEF',
+            'Other Users.Test2',
+            'Shared.Test1',
+        ];
+
+        $result = $object->sort_folder_list($folders);
+
+        $this->assertSame($expected, $result);
+    }
 }

roundcubemail-1.4.4.14.tar.gz/tests/Framework/Washtml.php -> roundcubemail-1.4.7.tar.gz/tests/Framework/Washtml.php Changed

@@ -316,6 +316,44 @@
     }
 
     /**
+     * Test SVG cleanup
+     */
+    function test_wash_svg2()
+    {
+        $svg = '<head xmlns="&quot;&gt;&lt;script&gt;alert(document.domain)&lt;/script&gt;"><svg></svg></head>';
+        $exp = '<svg xmlns="http://www.w3.org/1999/xhtml"></svg>';
+
+        $washer = new rcube_washtml;
+        $washed = $washer->wash($svg);
+
+        $this->assertSame($washed, $exp, "SVG content");
+
+        $svg = '<head xmlns="&quot; onload=&quot;alert(document.domain)">Hello victim!<svg></svg></head>';
+        $exp = 'Hello victim!<svg xmlns="http://www.w3.org/1999/xhtml"></svg>';
+
+        $washer = new rcube_washtml;
+        $washed = $washer->wash($svg);
+
+        $this->assertSame($washed, $exp, "SVG content");
+
+        $svg = '<p>Hello victim!<svg xmlns="&quot; onload=&quot;alert(document.domain)"></svg></p>';
+        $exp = '<p>Hello victim!<svg /></p>';
+
+        $washer = new rcube_washtml;
+        $washed = $washer->wash($svg);
+
+        $this->assertSame($washed, $exp, "SVG content");
+
+        $svg = '<svg xmlns="&quot; onload=&quot;alert(document.domain)" />';
+        $exp = '<svg xmlns="&quot; onload=&quot;alert(document.domain)" />';
+
+        $washer = new rcube_washtml;
+        $washed = $washer->wash($svg);
+
+        $this->assertSame($washed, $exp, "SVG content");
+    }
+
+    /**
      * Test position:fixed cleanup - (#5264)
      */
     function test_style_wash_position_fixed()

roundcubemail.dsc Changed

Overview

Request 2748 (accepted)

Request History