From ee883ad73d64639eb994a71e15b1a37c07ff3cb9 Mon Sep 17 00:00:00 2001
From: thomascube <thomas@roundcube.net>
Date: Fri, 22 Dec 2006 16:45:21 -0500
Subject: [PATCH] Applied security patches by Kees Cook (Ubuntu) + little visual enhancements
---
program/steps/mail/func.inc | 7 ++++---
1 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc
index f01e95b..57f20e5 100644
--- a/program/steps/mail/func.inc
+++ b/program/steps/mail/func.inc
@@ -739,7 +739,7 @@
'/url\s*\(["\']?([\.\/]+[^"\'\s]+)["\']?\)/i',
'/<script.+<\/script>/Umis');
- $remote_replaces = array('<img \\1src=\\2./program/blank.gif\\4',
+ $remote_replaces = array('<img \\1src=\\2./program/blocked.gif\\4',
'',
'',
'',
@@ -1210,7 +1210,8 @@
}
// replace event handlers on any object
- $body = preg_replace('/\s(on[a-z]+)=/im', ' __removed=', $body);
+ $body = preg_replace('/\s(on[^=]+)=/im', ' __removed=', $body);
+ $body = preg_replace('/\shref=["\']?(javascript:)/im', 'null:', $body);
// resolve <base href>
$base_reg = '/(<base.*href=["\']?)([hftps]{3,5}:\/{2}[^"\'\s]+)([^<]*>)/i';
@@ -1251,7 +1252,7 @@
if (stristr((string)$attrib['href'], 'mailto:'))
$attrib['onclick'] = sprintf("return %s.command('compose','%s',this)",
$GLOBALS['JS_OBJECT_NAME'],
- substr($attrib['href'], 7));
+ JQ(substr($attrib['href'], 7)));
else if (!empty($attrib['href']) && $attrib['href']{0}!='#')
$attrib['target'] = '_blank';
--
Gitblit v1.9.1