Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-08-25 10:09:20 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Improved app security

Browse source
This commit is contained in:
RainLoop Team 2019-07-02 00:20:27 +03:00
parent b244462fa5
commit 8eb4588917
4 changed files with 20 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

7
rainloop/v/0.0.0/app/libraries/MailSo/Base/HtmlUtils.php
View file

@ -1100,6 +1100,13 @@ class HtmlUtils
}
}
$sLinkHref = \trim($oElement->getAttribute('xlink:href'));
if ($sLinkHref && !\preg_match('/^(http[s]?):/i', $sLinkHref) && '//' !== \substr($sLinkHref, 0, 2))
{
$oElement->setAttribute('data-x-blocked-xlink-href', $sLinkHref);
$oElement->removeAttribute('xlink:href');
}
if (\in_array($sTagNameLower, array('a', 'form', 'area')))
{
$oElement->setAttribute('target', '_blank');