From 2d2af72c22e7b3aca2f90f10bcda1c73767d9656 Mon Sep 17 00:00:00 2001
From: Thomas Bruederli <thomas@roundcube.net>
Date: Tue, 24 Jul 2012 06:25:28 -0400
Subject: [PATCH] Correctly quote localized labels when used in javascript variables (#1488567)
---
CHANGELOG | 1 +
skins/larry/includes/footer.html | 2 +-
program/include/rcube_template.php | 10 +++++++++-
3 files changed, 11 insertions(+), 2 deletions(-)
diff --git a/CHANGELOG b/CHANGELOG
index 3e07da5..b0b9643 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,7 @@
CHANGELOG Roundcube Webmail
===========================
+- Correctly escape localized labels in javascript variable (#1488567)
- Update Net_SMTP/Auth_SASL packages to fix Digest-MD5/Cram-MD5 authentication (#1488571)
- Don't add attachments content into reply/forward/draft message body (#1488557)
- Fix 'no connection' errors on page unloads (#1488547)
diff --git a/program/include/rcube_template.php b/program/include/rcube_template.php
index e779f5a..19510ce 100644
--- a/program/include/rcube_template.php
+++ b/program/include/rcube_template.php
@@ -711,7 +711,15 @@
$vars = $attrib + array('product' => $this->config['product_name']);
unset($vars['name'], $vars['command']);
$label = rcube_label($attrib + array('vars' => $vars));
- return !$attrib['noshow'] ? (get_boolean((string)$attrib['html']) ? $label : Q($label)) : '';
+ $quoting = !empty($attrib['quoting']) ? strtolower($attrib['quoting']) : (get_boolean((string)$attrib['html']) ? 'no' : '');
+ switch ($quoting) {
+ case 'no':
+ case 'raw': break;
+ case 'javascript':
+ case 'js': $label = JQ($label); break;
+ default: $label = Q($label); break;
+ }
+ return !$attrib['noshow'] ? $label : '';
}
break;
diff --git a/skins/larry/includes/footer.html b/skins/larry/includes/footer.html
index 4a6f8f0..ee93fcf 100644
--- a/skins/larry/includes/footer.html
+++ b/skins/larry/includes/footer.html
@@ -3,7 +3,7 @@
// UI startup
var UI = new rcube_mail_ui();
$(document).ready(function(){
- UI.set('errortitle', '<roundcube:label name="errortitle" />');
+ UI.set('errortitle', '<roundcube:label name="errortitle" quoting="javascript" />');
UI.init();
});
--
Gitblit v1.9.1