|
|
@ -73,6 +73,7 @@
|
|
|
|
* Roundcube Changes:
|
|
|
|
* Roundcube Changes:
|
|
|
|
* - added $block_elements
|
|
|
|
* - added $block_elements
|
|
|
|
* - changed $ignore_elements behaviour
|
|
|
|
* - changed $ignore_elements behaviour
|
|
|
|
|
|
|
|
* - added RFC2397 support
|
|
|
|
*/
|
|
|
|
*/
|
|
|
|
|
|
|
|
|
|
|
|
class washtml
|
|
|
|
class washtml
|
|
|
@ -144,13 +145,16 @@ class washtml
|
|
|
|
')\s*/i', $str, $match)) {
|
|
|
|
')\s*/i', $str, $match)) {
|
|
|
|
if ($match[2]) {
|
|
|
|
if ($match[2]) {
|
|
|
|
if ($src = $this->config['cid_map'][$match[2]])
|
|
|
|
if ($src = $this->config['cid_map'][$match[2]])
|
|
|
|
$value .= ' url(\''.htmlspecialchars($src, ENT_QUOTES) . '\')';
|
|
|
|
$value .= ' url('.htmlspecialchars($src, ENT_QUOTES) . ')';
|
|
|
|
else if (preg_match('/^(http|https|ftp):.*$/i', $match[2], $url)) {
|
|
|
|
else if (preg_match('/^(http|https|ftp):.*$/i', $match[2], $url)) {
|
|
|
|
if ($this->config['allow_remote'])
|
|
|
|
if ($this->config['allow_remote'])
|
|
|
|
$value .= ' url(\''.htmlspecialchars($url[0], ENT_QUOTES).'\')';
|
|
|
|
$value .= ' url('.htmlspecialchars($url[0], ENT_QUOTES).')';
|
|
|
|
else
|
|
|
|
else
|
|
|
|
$this->extlinks = true;
|
|
|
|
$this->extlinks = true;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
else if (preg_match('/^data:.+/i', $url)) { // RFC2397
|
|
|
|
|
|
|
|
$value .= ' url('.htmlspecialchars($url, ENT_QUOTES).')';
|
|
|
|
|
|
|
|
}
|
|
|
|
} else if ($match[0] != 'url' && $match[0] != 'rbg') //whitelist ?
|
|
|
|
} else if ($match[0] != 'url' && $match[0] != 'rbg') //whitelist ?
|
|
|
|
$value .= ' ' . $match[0];
|
|
|
|
$value .= ' ' . $match[0];
|
|
|
|
$str = substr($str, strlen($match[0]));
|
|
|
|
$str = substr($str, strlen($match[0]));
|
|
|
@ -188,6 +192,9 @@ class washtml
|
|
|
|
$t .= ' ' . $key . '="' . htmlspecialchars($this->config['blocked_src'], ENT_QUOTES) . '"';
|
|
|
|
$t .= ' ' . $key . '="' . htmlspecialchars($this->config['blocked_src'], ENT_QUOTES) . '"';
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
else if (preg_match('/^data:.+/i', $value)) { // RFC2397
|
|
|
|
|
|
|
|
$t .= ' ' . $key . '="' . htmlspecialchars($value, ENT_QUOTES) . '"';
|
|
|
|
|
|
|
|
}
|
|
|
|
} else
|
|
|
|
} else
|
|
|
|
$washed .= ($washed?' ':'') . $key;
|
|
|
|
$washed .= ($washed?' ':'') . $key;
|
|
|
|
}
|
|
|
|
}
|
|
|
|