From 2b017e7f79be26563ab767bb9e97fee5d88a01f4 Mon Sep 17 00:00:00 2001
From: thomascube <thomas@roundcube.net>
Date: Fri, 09 Dec 2011 16:13:54 -0500
Subject: [PATCH] Allow clean background:url(...) styles in safe mode. This will make Roundcube pass the Email Standards Acid Test
---
program/include/rcube_template.php | 40 ++++++++++++++++++++++++++++++++++++++--
1 files changed, 38 insertions(+), 2 deletions(-)
diff --git a/program/include/rcube_template.php b/program/include/rcube_template.php
index 11c251a..06503f2 100755
--- a/program/include/rcube_template.php
+++ b/program/include/rcube_template.php
@@ -71,6 +71,7 @@
//$this->framed = $framed;
$this->set_env('task', $task);
+ $this->set_env('x_frame_options', $this->app->config->get('x_frame_options', 'sameorigin'));
// load the correct skin (in case user-defined)
$this->set_skin($this->config['skin']);
@@ -93,6 +94,7 @@
'username' => array($this, 'current_username'),
'message' => array($this, 'message_container'),
'charsetselector' => array($this, 'charset_selector'),
+ 'aboutcontent' => array($this, 'about_content'),
));
}
@@ -433,7 +435,11 @@
// trigger generic hook where plugins can put additional content to the page
$hook = $this->app->plugins->exec_hook("render_page", array('template' => $realname, 'content' => $output));
- $output = $this->parse_with_globals($hook['content']);
+ // save some memory
+ $output = $hook['content'];
+ unset($hook['content']);
+
+ $output = $this->parse_with_globals($output);
// make sure all <form> tags have a valid request token
$output = preg_replace_callback('/<form\s+([^>]+)>/Ui', array($this, 'alter_form_tag'), $output);
@@ -444,7 +450,7 @@
if ($realname != 'error' && ($this->config['debug_level'] & 8)) {
$this->add_footer('<div id="console" style="position:absolute;top:5px;left:5px;width:405px;padding:2px;background:white;z-index:9000;display:none">
<a href="#toggle" onclick="con=$(\'#dbgconsole\');con[con.is(\':visible\')?\'hide\':\'show\']();return false">console</a>
- <textarea name="console" id="dbgconsole" rows="20" cols="40" wrap="off" style="display:none;width:400px;border:none;font-size:10px" spellcheck="false"></textarea></div>'
+ <textarea name="console" id="dbgconsole" rows="20" cols="40" style="display:none;width:400px;border:none;font-size:10px" spellcheck="false"></textarea></div>'
);
$this->add_script(
"if (!window.console || !window.console.log) {\n".
@@ -742,6 +748,9 @@
else if (function_exists($handler)) {
$content = call_user_func($handler, $attrib);
}
+ else if ($object == 'doctype') {
+ $content = html::doctype($attrib['value']);
+ }
else if ($object == 'logo') {
$attrib += array('alt' => $this->xml_command(array('', 'object', 'name="productname"')));
if ($this->config['skin_logo'])
@@ -915,6 +924,7 @@
// make valid href to specific buttons
if (in_array($attrib['command'], rcmail::$main_tasks)) {
$attrib['href'] = rcmail_url(null, null, $attrib['command']);
+ $attrib['onclick'] = sprintf("%s.switch_task('%s');return false", JS_OBJECT_NAME, $attrib['command']);
}
else if ($attrib['task'] && in_array($attrib['task'], rcmail::$main_tasks)) {
$attrib['href'] = rcmail_url($attrib['command'], null, $attrib['task']);
@@ -964,6 +974,8 @@
else if ($attrib['type']=='link') {
$btn_content = isset($attrib['content']) ? $attrib['content'] : ($attrib['label'] ? $attrib['label'] : $attrib['command']);
$link_attrib = array('href', 'onclick', 'title', 'id', 'class', 'style', 'tabindex', 'target');
+ if ($attrib['innerclass'])
+ $btn_content = html::span($attrib['innerclass'], $btn_content);
}
else if ($attrib['type']=='input') {
$attrib['type'] = 'button';
@@ -1324,6 +1336,30 @@
return $select->show($set);
}
+ /**
+ * Include content from config/about.<LANG>.html if available
+ */
+ private function about_content($attrib)
+ {
+ $content = '';
+ $filenames = array(
+ 'about.' . $_SESSION['language'] . '.html',
+ 'about.' . substr($_SESSION['language'], 0, 2) . '.html',
+ 'about.html',
+ );
+ foreach ($filenames as $file) {
+ $fn = RCMAIL_CONFIG_DIR . '/' . $file;
+ if (is_readable($fn)) {
+ $content = file_get_contents($fn);
+ $content = $this->parse_conditions($content);
+ $content = $this->parse_xml($content);
+ break;
+ }
+ }
+
+ return $content;
+ }
+
} // end class rcube_template
--
Gitblit v1.9.1