[packages/squirrelmail.git] / squirrelmail-sm143a-xss.diff

diff -urN functions/mime.php functions/mime.php
--- functions/mime.php	2004-05-23 19:14:11.000000000 +0300
+++ functions/mime.php	2004-11-03 19:16:50.000000000 +0200
@@ -602,13 +602,22 @@
             }
             $iLastMatch = $i;
             $j = $i;
-            $ret .= $res[1];
+            if ($htmlsave) {
+                $ret .= htmlspecialchars($res[1]);
+            } else {
+                $ret .= $res[1];
+            }
             $encoding = ucfirst($res[3]);
             switch ($encoding)
             {
             case 'B':
                 $replace = base64_decode($res[4]);
-                $ret .= charset_decode($res[2],$replace);
+                if ($utfencode) {
+                    $replace = charset_decode($res[2],$replace);
+                } elseif ($htmlsave) {
+                    $replace = htmlspecialchars($replace);
+                }
+                $ret .= $replace;
                 break;
             case 'Q':
                 $replace = str_replace('_', ' ', $res[4]);
Commit	Line	Data
9642b721	1	diff -urN functions/mime.php functions/mime.php
	2	--- functions/mime.php 2004-05-23 19:14:11.000000000 +0300
	3	+++ functions/mime.php 2004-11-03 19:16:50.000000000 +0200
	4	@@ -602,13 +602,22 @@
	5	}
	6	$iLastMatch = $i;
	7	$j = $i;
	8	- $ret .= $res[1];
	9	+ if ($htmlsave) {
	10	+ $ret .= htmlspecialchars($res[1]);
	11	+ } else {
	12	+ $ret .= $res[1];
	13	+ }
	14	$encoding = ucfirst($res[3]);
	15	switch ($encoding)
	16	{
	17	case 'B':
	18	$replace = base64_decode($res[4]);
	19	- $ret .= charset_decode($res[2],$replace);
	20	+ if ($utfencode) {
	21	+ $replace = charset_decode($res[2],$replace);
	22	+ } elseif ($htmlsave) {
	23	+ $replace = htmlspecialchars($replace);
	24	+ }
	25	+ $ret .= $replace;
	26	break;
	27	case 'Q':
	28	$replace = str_replace('_', ' ', $res[4]);