From ebfa39619539fcc7eab4465abe3594ee649c66af Mon Sep 17 00:00:00 2001 From: Hadi Nategh Date: Mon, 13 Dec 2021 16:40:32 +0100 Subject: [PATCH] Decode html entities used in inline image sources because tinymce encodes them --- api/src/Mail.php | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/api/src/Mail.php b/api/src/Mail.php index ed49d0db7e..890b1d4d49 100644 --- a/api/src/Mail.php +++ b/api/src/Mail.php @@ -6789,7 +6789,10 @@ class Mail $ext = pathinfo($attachmentData['name'], PATHINFO_EXTENSION); $attachmentData['type'] = MimeMagic::ext2mime($ext); if ( strlen($directory) > 1 && !str_ends_with($directory, '/')) { $directory .= '/'; } - $myUrl = $directory.$attachmentData['name']; + + //decode entities because tinymce encodes (e.g. Umlautes) them otherwise file can't be found. + $myUrl = html_entity_decode($directory.$attachmentData['name']); + if ($myUrl[0]=='/') // local path -> we only allow path's that are available via http/https (or vfs) { $basedir = Framework::getUrl('/');