extern/egroupware_official
1
0
Fork 0
mirror of https://github.com/EGroupware/egroupware.git synced 2024-11-22 16:03:47 +01:00
Code Issues Packages Projects Releases Wiki Activity

allow images and media in mail via http: and https:, but remove object tags (already forbiden via CSP)

Browse Source
This commit is contained in:
Ralf Becker 2020-01-29 14:40:30 +01:00
parent cdab5914c2
commit b65b21fe9c
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
api/src/Mail.php
View File

@ -141,7 +141,7 @@ class Mail
// tidy eats away even some wanted whitespace, so we switch it off; // tidy eats away even some wanted whitespace, so we switch it off;
// we used it for its compacting and beautifying capabilities, which resulted in better html for further processing // we used it for its compacting and beautifying capabilities, which resulted in better html for further processing
'tidy'=>0, 'tidy'=>0,
'elements' => "* -script -meta", 'elements' => "* -script -meta -object",
'deny_attribute' => 'on*', 'deny_attribute' => 'on*',
'schemes'=>'href: file, ftp, http, https, mailto, phone, tel; src: cid, data, file, ftp, http, https; *:file, http, https, cid, src', 'schemes'=>'href: file, ftp, http, https, mailto, phone, tel; src: cid, data, file, ftp, http, https; *:file, http, https, cid, src',
'hook_tag' =>"hl_email_tag_transform", 'hook_tag' =>"hl_email_tag_transform",

4
mail/inc/class.mail_ui.inc.php
View File

@ -3269,11 +3269,13 @@ $filter['before']= date("d-M-Y", $cutoffdate2);
Api\Session::cache_control(true); Api\Session::cache_control(true);
// more strict CSP for displaying mail // more strict CSP for displaying mail
foreach(['frame-src', 'connect-src', 'manifest-src', 'media-src'] as $src) foreach(['frame-src', 'connect-src', 'manifest-src'] as $src)
{ {
Api\Header\ContentSecurityPolicy::add($src, 'none'); Api\Header\ContentSecurityPolicy::add($src, 'none');
} }
Api\Header\ContentSecurityPolicy::add('script-src', 'self', true); // true = remove default 'unsafe-eval' Api\Header\ContentSecurityPolicy::add('script-src', 'self', true); // true = remove default 'unsafe-eval'
Api\Header\ContentSecurityPolicy::add('img-src', 'http:');
Api\Header\ContentSecurityPolicy::add('media-src', ['https:','http:']);
} }
// Compose the content of the frame // Compose the content of the frame
$frameHtml = $frameHtml =