extern/egroupware
1
0
Fork 1
mirror of https://github.com/EGroupware/egroupware.git synced 2025-01-01 03:29:05 +01:00
Code Issues Packages Projects Releases Wiki Activity

Decode html entities used in inline image sources because tinymce encodes them

Browse Source
This commit is contained in:
Hadi Nategh 2021-12-13 16:40:32 +01:00
parent d2cd36656a
commit ebfa396195
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
api/src/Mail.php
View File

@ -6789,7 +6789,10 @@ class Mail
$ext = pathinfo($attachmentData['name'], PATHINFO_EXTENSION); $ext = pathinfo($attachmentData['name'], PATHINFO_EXTENSION);
$attachmentData['type'] = MimeMagic::ext2mime($ext); $attachmentData['type'] = MimeMagic::ext2mime($ext);
if ( strlen($directory) > 1 && !str_ends_with($directory, '/')) { $directory .= '/'; } if ( strlen($directory) > 1 && !str_ends_with($directory, '/')) { $directory .= '/'; }
$myUrl = $directory.$attachmentData['name'];
//decode entities because tinymce encodes (e.g. Umlautes) them otherwise file can't be found.
$myUrl = html_entity_decode($directory.$attachmentData['name']);
if ($myUrl[0]=='/') // local path -> we only allow path's that are available via http/https (or vfs) if ($myUrl[0]=='/') // local path -> we only allow path's that are available via http/https (or vfs)
{ {
$basedir = Framework::getUrl('/'); $basedir = Framework::getUrl('/');