Fix XSS vulnerability when editing a message "as new" or draft (#1489251) -...

Aleksander Machniak

2013-08-01 93b0a30c1c8aa29d862b587b31e52bcc344b8d16

 program/js/editor.js

@@ -41,7 +41,7 @@
    $.extend(conf, {
      plugins: 'paste,tabfocus',
      theme_advanced_buttons1: 'bold,italic,underline,strikethrough,justifyleft,justifycenter,justifyright,justifyfull,separator,outdent,indent,charmap,hr,link,unlink,code,forecolor',
      theme_advanced_buttons2: ',fontselect,fontsizeselect'
      theme_advanced_buttons2: 'fontselect,fontsizeselect'
    });
  else { // mail compose
    $.extend(conf, {
@@ -80,7 +80,7 @@
  if (rcmail.env.default_font)
    $(tinyMCE.get(rcmail.env.composebody).getBody()).css('font-family', rcmail.env.default_font);

  if (elem && elem.type == 'select-one' && !rcmail.env.opened_extwin) {
  if (elem && elem.type == 'select-one') {
    rcmail.change_identity(elem);
    // Focus previously focused element
    if (fe && fe.id != rcmail.env.composebody) {