diff --git a/api/src/Html/HtmLawed.php b/api/src/Html/HtmLawed.php
index 58020891e7..e4d88d1783 100644
--- a/api/src/Html/HtmLawed.php
+++ b/api/src/Html/HtmLawed.php
@@ -11,6 +11,8 @@
*/
namespace EGroupware\Api\Html;
+use EGroupware\Api;
+use translation;
require_once(__DIR__.'/htmLawed/htmLawed.php');
@@ -136,7 +138,7 @@ class HtmLawed
{
//error_log(__METHOD__.__LINE__.array2string($newStyle[0]));
$style2buffer = implode('',$newStyle[0]);
- // only replace what we have found, we use it here, as we use the same routine in Translation::replaceTagsCompletley
+ // only replace what we have found, we use it here, as we use the same routine in translation::replaceTagsCompletley
// no need to do the extra routine
$html = str_ireplace($newStyle[0],'',$html);
}
@@ -149,7 +151,7 @@ class HtmLawed
if ($test=="null" && strlen($style2buffer)>0)
{
// this should not be needed, unless something fails with charset detection/ wrong charset passed
- error_log(__METHOD__.__LINE__.' Found Invalid sequence for utf-8 in CSS:'.$style2buffer.' Carset Detected:'.Translation::detect_encoding($style2buffer));
+ error_log(__METHOD__.__LINE__.' Found Invalid sequence for utf-8 in CSS:'.$style2buffer.' Carset Detected:'.Api\Translation::detect_encoding($style2buffer));
$style2buffer = utf8_encode($style2buffer);
}
}
@@ -165,15 +167,15 @@ class HtmLawed
// CSS Security
// http://code.google.com/p/browsersec/wiki/Part1#Cascading_stylesheets
$css = preg_replace('/(javascript|expession|-moz-binding)/i','',$style);
- if (stripos($css,'script')!==false) Translation::replaceTagsCompletley($css,'script'); // Strip out script that may be included
+ if (stripos($css,'script')!==false) translation::replaceTagsCompletley($css,'script'); // Strip out script that may be included
// we need this, as styledefinitions are enclosed with curly brackets; and template stuff tries to replace everything between curly brackets that is having no horizontal whitespace
// as the comments as in stylesheet are outdated, and ck-editor does not understand it, we remove it
$css_no_comment = str_replace(array(':',''),array(': ','',''),$css);
//error_log(__METHOD__.__LINE__.$css);
- // we already removed what we have found, above, as we used pretty much the same routine as in Translation::replaceTagsCompletley
+ // we already removed what we have found, above, as we used pretty much the same routine as in translation::replaceTagsCompletley
// no need to do the extra routine
// TODO: we may have to strip urls and maybe comments and ifs
- //if (stripos($html,'style')!==false) Translation::replaceTagsCompletley($html,'style'); // clean out empty or pagewide style definitions / left over tags
+ //if (stripos($html,'style')!==false) translation::replaceTagsCompletley($html,'style'); // clean out empty or pagewide style definitions / left over tags
return $css_no_comment;
}
@@ -389,17 +391,21 @@ function hl_email_tag_transform($element, $attribute_array=0)
if (!isset($attribute_array['title'])) $attribute_array['title']=$attribute_array['alt'];
$attribute_array['src']=common::image('phpgwapi','dialog_error');
}
- if (!$GLOBALS['egw_info']['user']['preferences']['mail']['allowExternalIMGs'])
+ if (!preg_match('/^cid:.*/',$attribute_array['src']))
{
- if (!preg_match('/^cid:.*/',$attribute_array['src']))
+ if (!$GLOBALS['egw_info']['user']['preferences']['mail']['allowExternalIMGs'])
{
- $attribute_array['alt']= $attribute_array['alt'].' [blocked external image:'.$attribute_array['src'].']';
- if (!isset($attribute_array['title'])) $attribute_array['title']=$attribute_array['alt'];
- $attribute_array['src']=common::image('mail','no-image-shown');
- $attribute_array['border'] = 1;
- if ($attribute_array['style'])
+ //the own webserver url is not external, so it should be allowed
+ if (empty($GLOBALS['egw_info']['server']['webserver_url'])||!preg_match("$^".$GLOBALS['egw_info']['server']['webserver_url'].".*$",$attribute_array['src']))
{
- if (stripos($attribute_array['style'],'border')!==false) $attribute_array['style'] = preg_replace('~border(:|-left:|-right:|-bottom:|-top:)+ (0px)+ (none)+;~si','',$attribute_array['style']);
+ $attribute_array['alt']= $attribute_array['alt'].' [blocked external image:'.$attribute_array['src'].']';
+ if (!isset($attribute_array['title'])) $attribute_array['title']=$attribute_array['alt'];
+ $attribute_array['src']=common::image('mail','no-image-shown');
+ $attribute_array['border'] = 1;
+ if ($attribute_array['style'])
+ {
+ if (stripos($attribute_array['style'],'border')!==false) $attribute_array['style'] = preg_replace('~border(:|-left:|-right:|-bottom:|-top:)+ (0px)+ (none)+;~si','',$attribute_array['style']);
+ }
}
}
}