Fix typos + only add callback for style tags when safe-flag is set

thomascube

2008-09-16 36c236eee7529eae962d7e7c5ec925d2d417c7b8

Fix typos + only add callback for style tags when safe-flag is set

 program/include/html.php

@@ -33,7 +33,7 @@
    protected $content;

    public static $common_attrib = array('id','class','style','title','align');
    public static $containers = array('div','span','p','h1','h2','h3','form','textarea','table','tr','th','td');
    public static $containers = array('div','span','p','h1','h2','h3','form','textarea','table','tr','th','td','style');
    public static $lc_tags = true;

    /**

 program/steps/mail/func.inc

@@ -611,14 +611,13 @@
      $wash_opts['html_elements'] = array('html','head','title','body');
    }
    
    // allow CSS styles, will be sanitized by rcmail_washtml_callback()
    if ($p['safe']) {
      $wash_opts['html_elements'][] = 'style';
    }
    
    $washer = new washtml($wash_opts);
    $washer->add_callback('form', 'rcmail_washtml_callback');
    
    if ($p['safe']) {  // allow CSS styles, will be sanitized by rcmail_washtml_callback()
    $washer->add_callback('style', 'rcmail_washtml_callback');
    }
    
    $body = $washer->wash($html);
    $REMOTE_OBJECTS = $washer->extlinks;

@@ -708,10 +707,10 @@
      
    case 'style':
      // decode all escaped entities and reduce to ascii strings
      $stripped = preg_replace('/[^a-zA-Z\(:]/', '', rcmail_xss_entitiy_decode($source));
      $stripped = preg_replace('/[^a-zA-Z\(:]/', '', rcmail_xss_entitiy_decode($content));
      
      // now check for evli strings like expression, behavior or url()
      if (!preg_match('/expression|behavior|url\(|import/', $css)) {
      // now check for evil strings like expression, behavior or url()
      if (!preg_match('/expression|behavior|url\(|import/', $stripped)) {
        $out = html::tag('style', array('type' => 'text/css'), $content);
        break;
      }