Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-08-25 18:19:22 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Use only allowed attributes in the html parser.

Browse source
This commit is contained in:
RainLoop Team 2016-07-13 22:38:20 +03:00
parent 0a6a84b3d7
commit 5a01b59d40
11 changed files with 137 additions and 1328 deletions
Download patch file Download diff file Expand all files Collapse all files

21
rainloop/v/0.0.0/app/libraries/RainLoop/Actions.php
View file

@ -9968,24 +9968,6 @@ NewThemeLink IncludeCss LoadingDescriptionEsc TemplatesLink LangLink IncludeBack
$mResult['InReplyTo'] = $mResponse->InReplyTo();
$mResult['References'] = $mResponse->References();
$fAdditionalDomReader = null;
if (0 < \strlen($sHtml) && $this->Config()->Get('labs', 'emogrifier', false))
{
if (!\class_exists('RainLoopVendor\Pelago\Emogrifier', false))
{
include_once APP_VERSION_ROOT_PATH.'app/libraries/emogrifier/Emogrifier.php';
}
if (\class_exists('RainLoopVendor\Pelago\Emogrifier', false))
{
$fAdditionalDomReader = function ($oDom) {
$oEmogrifier = new \RainLoopVendor\Pelago\Emogrifier();
$oEmogrifier->preserveEncoding = false;
return $oEmogrifier->emogrify($oDom);
};
}
}
$fAdditionalExternalFilter = null;
if (!!$this->Config()->Get('labs', 'use_local_proxy_for_external_images', false))
{
@ -10004,8 +9986,7 @@ NewThemeLink IncludeCss LoadingDescriptionEsc TemplatesLink LangLink IncludeBack
$mResult['Html'] = 0 === \strlen($sHtml) ? '' : \MailSo\Base\HtmlUtils::ClearHtml(
$sHtml, $bHasExternals, $mFoundedCIDs, $aContentLocationUrls, $mFoundedContentLocationUrls, false, false,
$fAdditionalExternalFilter, $fAdditionalDomReader,
!!$this->Config()->Get('labs', 'try_to_detect_hidden_images', false)
$fAdditionalExternalFilter, null, !!$this->Config()->Get('labs', 'try_to_detect_hidden_images', false)
);
$mResult['ExternalProxy'] = null !== $fAdditionalExternalFilter;

46
rainloop/v/0.0.0/app/libraries/RainLoop/Api.php
View file

@ -134,6 +134,52 @@ class Api
}
});
}
\MailSo\Config::$HtmlStrictDebug = !!\RainLoop\Api::Config()->Get('debug', 'enable', false);
if (\RainLoop\Api::Config()->Get('labs', 'strict_html_parser', true))
{
\MailSo\Config::$HtmlStrictAllowedAttributes = array(
// rainloop
'data-wrp',
// defaults
'name',
'dir', 'lang', 'style', 'title',
'background', 'bgcolor', 'alt', 'height', 'width', 'src', 'href',
'border', 'bordercolor', 'charset', 'direction', 'language',
// a
'coords', 'download', 'hreflang', 'shape',
// body
'alink', 'bgproperties', 'bottommargin', 'leftmargin', 'link', 'rightmargin', 'text', 'topmargin', 'vlink',
'marginwidth', 'marginheight', 'offset',
// button,
'disabled', 'type', 'value',
// col
'align', 'valign',
// font
'color', 'face', 'size',
// form
'novalidate',
// hr
'noshade',
// img
'hspace', 'sizes', 'srcset', 'vspace', 'usemap',
// input, textarea
'checked', 'max', 'min', 'maxlength', 'multiple', 'pattern', 'placeholder', 'readonly', 'required', 'step', 'wrap',
// label
'for',
// meter
'low', 'high', 'optimum',
// ol
'reversed', 'start',
// option
'selected', 'label',
// table
'cols', 'rows', 'frame', 'rules', 'summary', 'cellpadding', 'cellspacing',
// td
'abbr', 'axis', 'colspan', 'rowspan', 'headers', 'nowrap'
);
}
}
}

2
rainloop/v/0.0.0/app/libraries/RainLoop/Config/Application.php
View file

@ -446,8 +446,8 @@ Enables caching in the system'),
'cookie_default_secure' => array(false),
'replace_env_in_configuration' => array(''),
'startup_url' => array(''),
'emogrifier' => array(true),
'nice_social_redirect' => array(true),
'strict_html_parser' => array(false),
'dev_email' => array(''),
'dev_password' => array('')
),