Allow clean background:url(...) styles in safe mode. This will make Roundcu...

thomascube

2011-12-09 2b017e7f79be26563ab767bb9e97fee5d88a01f4

 program/include/rcube_string_replacer.php

@@ -5,7 +5,7 @@
 | program/include/rcube_string_replacer.php                             |
 |                                                                       |
 | This file is part of the Roundcube Webmail client                     |
 | Copyright (C) 2009, Roundcube Dev. - Switzerland                      |
 | Copyright (C) 2009, The Roundcube Dev Team                            |
 | Licensed under the GNU GPL                                            |
 |                                                                       |
 | PURPOSE:                                                              |
@@ -36,14 +36,16 @@
  function __construct()
  {
    // Simplified domain expression for UTF8 characters handling
    $utf_domain = '[^?&@"\'\\/()\s\r\t\n]+\\.[a-z]{2,5}';
    $url = '[a-z0-9%=#@+?.:;&\\/_~\\[\\]-]+';
    // Support unicode/punycode in top-level domain part
    $utf_domain = '[^?&@"\'\\/()\s\r\t\n]+\\.([^\\x00-\\x2f\\x3b-\\x40\\x5b-\\x60\\x7b-\\x7f]{2,}|xn--[a-z0-9]{2,})';
    $url1 = '.:;,';
    $url2 = 'a-z0-9%=#@+?!&\\/_~\\[\\]{}-';

    $this->link_pattern = "/([\w]+:\/\/|\Wwww\.)($utf_domain($url)?)/i";
    $this->link_pattern = "/([\w]+:\/\/|\Wwww\.)($utf_domain([$url1]?[$url2]+)*)/i";
    $this->mailto_pattern = "/("
        ."[-\w!\#\$%&\'*+~\/^`|{}=]+(?:\.[-\w!\#\$%&\'*+~\/^`|{}=]+)*"  // local-part
        ."@$utf_domain"                                                 // domain-part
        ."(\?$url)?"                                                    // e.g. ?subject=test...
        ."(\?[$url1$url2]+)?"                                           // e.g. ?subject=test...
        .")/i";
  }

@@ -88,11 +90,13 @@
      $prefix     = $m[1];
    }

    $suffix = $this->parse_url_brackets($url);
    $i = $this->add($prefix . html::a(array(
      'href' => $url_prefix . $url,
      'target' => '_blank'
      ), Q($url)) . $suffix);
    if ($url) {
      $suffix = $this->parse_url_brackets($url);
      $i = $this->add($prefix . html::a(array(
          'href' => $url_prefix . $url,
          'target' => '_blank'
        ), Q($url)) . $suffix);
    }

    // Return valid link for recognized schemes, otherwise, return the unmodified string for unrecognized schemes.
    return $i >= 0 ? $this->get_replacement($i) : $matches[0];