From 0bac7b32de62006e925fb0b788c757b6c23b8a5e Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Wed, 07 Aug 2013 07:48:07 -0400
Subject: [PATCH] Fix wrong handling of links with '|' character (#1489276)
---
CHANGELOG | 1 +
tests/Framework/StringReplacer.php | 1 +
program/lib/Roundcube/rcube_string_replacer.php | 2 +-
3 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/CHANGELOG b/CHANGELOG
index fc65913..f50c0a3 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,7 @@
CHANGELOG Roundcube Webmail
===========================
+- Fix wrong handling of links with '|' character (#1489276)
- Fix XSS vulnerability when saving HTML signatures (#1489251)
- Move identity selection based on non-standard headers into (new) identity_select plugin (#1488553)
- Fix colorspace issue on image conversion using ImageMagick (#1489270)
diff --git a/program/lib/Roundcube/rcube_string_replacer.php b/program/lib/Roundcube/rcube_string_replacer.php
index d1f1f4d..354b459 100644
--- a/program/lib/Roundcube/rcube_string_replacer.php
+++ b/program/lib/Roundcube/rcube_string_replacer.php
@@ -37,7 +37,7 @@
// Support unicode/punycode in top-level domain part
$utf_domain = '[^?&@"\'\\/()<>\s\r\t\n]+\\.?([^\\x00-\\x2f\\x3b-\\x40\\x5b-\\x60\\x7b-\\x7f]{2,}|xn--[a-zA-Z0-9]{2,})';
$url1 = '.:;,';
- $url2 = 'a-zA-Z0-9%=#$@+?!&\\/_~\\[\\]\\(\\){}\*-';
+ $url2 = 'a-zA-Z0-9%=#$@+?|!&\\/_~\\[\\]\\(\\){}\*-';
$this->link_pattern = "/([\w]+:\/\/|\W[Ww][Ww][Ww]\.|^[Ww][Ww][Ww]\.)($utf_domain([$url1]*[$url2]+)*)/";
$this->mailto_pattern = "/("
diff --git a/tests/Framework/StringReplacer.php b/tests/Framework/StringReplacer.php
index 8f6eaf4..e23fb9b 100644
--- a/tests/Framework/StringReplacer.php
+++ b/tests/Framework/StringReplacer.php
@@ -41,6 +41,7 @@
array('http://', 'http://'),
array('1@1.com www.domain.tld', '<a href="mailto:1@1.com">1@1.com</a> <a href="http://www.domain.tld">www.domain.tld</a>'),
array(' www.domain.tld ', ' <a href="http://www.domain.tld">www.domain.tld</a> '),
+ array(' www.domain.tld/#!download|856p1|2 ', ' <a href="http://www.domain.tld/#!download|856p1|2">www.domain.tld/#!download|856p1|2</a> '),
);
}
--
Gitblit v1.9.1