Dereku/snappymail
0
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-11-04 03:18:49 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge remote-tracking branch 'ghsa-cjq6-6gwv-qxjj/advisory-fix-1'

Browse source
This commit is contained in:
djmaze 2026-11-03 15:28:28 +01:00
commit d3fec0da5f
1 changed files with 8 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

9
snappymail/v/0.0.0/app/libraries/RainLoop/Actions/Raw.php
View file

@ -234,14 +234,21 @@ trait Raw
\header('Content-Transfer-Encoding: binary'); \header('Content-Transfer-Encoding: binary');
} }
// https://github.com/the-djmaze/snappymail/security/advisories/GHSA-cjq6-6gwv-qxjj
$bSVG = ('image/svg+xml' === $sContentType) || ('.svg' === \substr($sFileName, -4));
$sLoadedData = null; $sLoadedData = null;
if ($bIsRangeRequest || !$bDownload) { if ($bIsRangeRequest || !$bDownload || $bSVG) {
$sLoadedData = \stream_get_contents($rResource); $sLoadedData = \stream_get_contents($rResource);
} }
\MailSo\Base\Utils::ResetTimeLimit(); \MailSo\Base\Utils::ResetTimeLimit();
if ($sLoadedData) { if ($sLoadedData) {
if ($bSVG) {
$sLoadedData = \str_replace('foreignObject' ,'foreign-Object', $sLoadedData);
}
if ($bIsRangeRequest && (\strlen($sRangeStart) || \strlen($sRangeEnd))) { if ($bIsRangeRequest && (\strlen($sRangeStart) || \strlen($sRangeEnd))) {
$iFullContentLength = \strlen($sLoadedData); $iFullContentLength = \strlen($sLoadedData);