Fix XSS issue in plain text spellchecker (#1489806)

pull/181/head
Aleksander Machniak 10 years ago
parent f4bd85b8d0
commit fd309c3650

@ -7,6 +7,7 @@ CHANGELOG Roundcube Webmail
- Fix unintentional redirect from compose page in Webkit browsers (#1489789)
- Fix messages index cache update under some conditions (e.g. proxy) (#1489756)
- Fix lack of translation of special folders in some configurations (#1489799)
- Fix XSS issue in plain text spellchecker (#1489806)
RELEASE 1.0.0
-------------

@ -524,7 +524,7 @@ this.showErrorWindow = function(elm, id)
$(dummy).html(suggestions[i]);
$(item).mouseover(this.item_onmouseover).mouseout(this.item_onmouseout)
.click(function(e) { ref.correctError(id, elm, e.target.firstChild) });
.click(function(e) { ref.correctError(id, elm, e.target.firstChild) });
item.appendChild(dummy);
row.appendChild(item);
@ -565,14 +565,15 @@ this.showErrorWindow = function(elm, id)
ref.saveOldValue(elm, elm.innerHTML);
ref.updateOrginalText(offset, elm.innerHTML, edit_input.value, id);
$(elm).attr('is_corrected', true).css('color', 'green').html(edit_input.value);
$(elm).attr('is_corrected', true).css('color', 'green').text(edit_input.value);
ref.hideErrorWindow();
}
return false;
};
$(edit_input).width(120).css({'margin': 0, 'padding': 0});
$(edit_input).val(elm.innerHTML).attr('googie_action_btn', '1');
$(edit_input).width(120)
.css({'margin': 0, 'padding': 0})
.val($(elm).text()).attr('googie_action_btn', '1');
$(edit).css('cursor', 'default').attr('googie_action_btn', '1');
$(ok_pic).attr('src', this.img_dir + 'ok.gif')

Loading…
Cancel
Save