extern/egroupware
1
0
Fork 1
mirror of https://github.com/EGroupware/egroupware.git synced 2025-06-26 04:41:41 +02:00
Code Issues Packages Projects Releases Wiki Activity

Fix a XSS issue in mailto temporary form post method

Browse Source
This commit is contained in:
Hadi Nategh 2015-06-09 16:19:47 +00:00
parent 35a4687e29
commit f7e15d31c4
1 changed files with 13 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
phpgwapi/js/jsapi/egw_open.js
View File

@ -66,15 +66,21 @@ egw.extend('open', egw.MODULE_WND_LOCAL, function(_egw, _wnd)
// Accoring to microsoft, IE 10/11 can only accept a url with 2083 caharacters // Accoring to microsoft, IE 10/11 can only accept a url with 2083 caharacters
// therefore we need to send request to compose window with POST method // therefore we need to send request to compose window with POST method
// instead of GET. We create a temporary <Form> and will post emails. // instead of GET. We create a temporary <Form> and will post emails.
if (uri.length > 2083 && navigator.userAgent.match(/Trident|MSIE|Edge/,"g")) // ** WebServers and other browsers also have url length limit:
// Firefox:~ 65k, Safari:80k, Chrome: 2MB, Apache: 4k, Nginx: 4k
if (uri.length > 2083)
{ {
popup = egw.open('','mail','add','','compose__','mail'); popup = egw.open('','mail','add','','compose__','mail');
popup.onload = new function(){ var $tmpForm = jQuery(document.createElement('form')).appendTo('body');
// Build a temp Form and submit right away var $tmpInput = jQuery(document.createElement('input')).attr({name:"preset[mailto]", type:"text", value: uri});
var $tmpForm = jQuery('<form method="post" target="'+popup.name+'" action="'+popup.location.href+'">\n\ var $tmpSubmitInput = jQuery(document.createElement('input')).attr({type:"submit"});
<input name="preset[mailto]" type="text" value="'+uri+'"></input><input type="submit"></input></form>').appendTo('body').submit(); // Set the temporary form's attributes
$tmpForm.remove(); $tmpForm.attr({target:popup.name, action:"index.php?menuaction=mail.mail_compose.compose", method:"post"})
}; .append($tmpInput)
.append($tmpSubmitInput);
$tmpForm.submit();
// Remove the form after submit
$tmpForm.remove();
} }
else // simple GET request else // simple GET request
{ {