diff --git a/CHANGELOG b/CHANGELOG index 88a54ca9a..7cfccdc68 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -11,6 +11,7 @@ CHANGELOG Roundcube Webmail - Managesieve: Fix bug where show_real_foldernames setting wasn't respected (#6422) - New_user_identity: Fix %fu/%u vars substitution in user specific LDAP params (#6419) - Fix support for "allow-from " in "x_frame_options" config option (#6449) +- Fix bug where valid content between HTML comments could have been skipped in some cases (#6464) RELEASE 1.3.7 ------------- diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php index ddffe62b7..5234f8995 100644 --- a/program/lib/Roundcube/rcube_washtml.php +++ b/program/lib/Roundcube/rcube_washtml.php @@ -632,6 +632,9 @@ class rcube_washtml return ''; } + // FIXME: HTML comments handling could be better. The code below can break comments (#6464), + // we should probably do not modify content inside comments at all. + // fix (unknown/malformed) HTML tags before "wash" $html = preg_replace_callback('/(<(?!\!)[\/]*)([^\s>]+)([^>]*)/', array($this, 'html_tag_callback'), $html); @@ -654,9 +657,15 @@ class rcube_washtml */ public static function html_tag_callback($matches) { + // It might be an ending of a comment, ignore (#6464) + if (substr($matches[3], -2) == '--') { + $matches[0] = ''; + return implode('', $matches); + } + $tagname = $matches[2]; $tagname = preg_replace(array( - '/:.*$/', // Microsoft's Smart Tags + '/:.*$/', // Microsoft's Smart Tags '/[^a-z0-9_\[\]\!?-]/i', // forbidden characters ), '', $tagname); diff --git a/tests/Framework/Washtml.php b/tests/Framework/Washtml.php index 6702a1bb2..166a4612a 100644 --- a/tests/Framework/Washtml.php +++ b/tests/Framework/Washtml.php @@ -90,6 +90,11 @@ class Framework_Washtml extends PHPUnit_Framework_TestCase $washed = $washer->wash($html); $this->assertEquals('

para1

para2

', $washed, "HTML comments - bracket inside"); + + $html = "

\n2\n4

"; + $washed = $washer->wash($html); + + $this->assertEquals("

\n2\n4

", $washed, "HTML comments (#6464)"); } /**