Changeset 0a1dd5b in github

Timestamp:

May 22, 2012 5:07:20 AM (12 months ago)

Author:

Aleksander Machniak <alec@…>

Branches:

master, HEAD, dev-browser-capabilities, pdo

Children:

041c93c

Parents:

5a575b7

Message:

Add is_escaped attribute for html_select and html_textarea (#1488485)

Files:

• CHANGELOG (modified) (1 diff)
• program/include/html.php (modified) (4 diffs)
• program/include/rcmail.php (modified) (4 diffs)
• program/steps/mail/compose.inc (modified) (1 diff)
• program/steps/settings/edit_identity.inc (modified) (1 diff)

CHANGELOG

@@ -2 +2 @@
 ===========================
 
+- Add is_escaped attribute for html_select and html_textarea (#1488485)
 - Fix HTML entities handling in HTML editor (#1488483)
 - Fix listing shared folders on Courier IMAP (#1488466)

program/include/html.php

@@ -299 +299 @@
             }
             else {
-                $attrib_arr[] = $key . '="' . self::quote($value) . '"';
+                $attrib_arr[] = $key . '="' . self::quote($value, true) . '"';
             }
         }
@@ -332 +332 @@
      * Replacing specials characters in html attribute value
      *
-     * @param  string  $str  Input string
+     * @param  string  $str       Input string
+     * @param  bool    $validate  Enables double quotation prevention
      *
      * @return string  The quoted string
      */
-    public static function quote($str)
+    public static function quote($str, $validate = false)
     {
         $str = htmlspecialchars($str, ENT_COMPAT, RCMAIL_CHARSET);
 
         // avoid douple quotation of &
-        // @TODO: get rid of it?
-        $str = preg_replace('/&([A-Za-z]{2,6}|#[0-9]{2,4});/', '&\\1;', $str);
+        // @TODO: get rid of it
+        if ($validate) {
+            $str = preg_replace('/&([A-Za-z]{2,6}|#[0-9]{2,4});/', '&\\1;', $str);
+        }
 
         return $str;
@@ -559 +562 @@
         }
 
-        if (!empty($value) && !preg_match('/mce_editor/', $this->attrib['class'])) {
-            $value = self::quote($value);
+        if (!empty($value) && empty($this->attrib['is_escaped'])) {
+            $value = self::quote($value, true);
         }
 
@@ -634 +637 @@
                   in_array($option['text'], $select, true)) ? 1 : null);
 
-            $this->content .= self::tag('option', $attr, self::quote($option['text']));
+            $option_content = $option['text'];
+            if (empty($this->attrib['is_escaped'])) {
+                $option_content = self::quote($option_content, true);
+            }
+
+            $this->content .= self::tag('option', $attr, $option_content);
         }
 

program/include/rcmail.php

@@ -1330 +1330 @@
 
         if ($type == 'select') {
+            $attrib['is_escaped'] = true;
             $select = new html_select($attrib);
 
             // add no-selection option
             if ($attrib['noselection']) {
-                $select->add($rcmail->gettext($attrib['noselection']), '');
+                $select->add(html::quote($rcmail->gettext($attrib['noselection'])), '');
             }
 
@@ -1363 +1364 @@
     public function folder_selector($p = array())
     {
-        $p += array('maxlength' => 100, 'realnames' => false);
+        $p += array('maxlength' => 100, 'realnames' => false, 'is_escaped' => true);
         $a_mailboxes = array();
         $storage = $this->get_storage();
@@ -1389 +1390 @@
 
         if ($p['noselection']) {
-            $select->add($p['noselection'], '');
+            $select->add(html::quote($p['noselection']), '');
         }
 
@@ -1580 +1581 @@
             }
 
-            $select->add(str_repeat(' ', $nestLevel*4) . $foldername, $folder['id']);
+            $select->add(str_repeat(' ', $nestLevel*4) . html::quote($foldername), $folder['id']);
 
             if (!empty($folder['folders'])) {

program/steps/mail/compose.inc

@@ -773 +773 @@
     $MESSAGE_BODY = htmlentities($MESSAGE_BODY, ENT_NOQUOTES, RCMAIL_CHARSET);
     $attrib['class'] = 'mce_editor';
+    $attrib['is_escaped'] = true;
     $textarea = new html_textarea($attrib);
     $out .= $textarea->show($MESSAGE_BODY);

program/steps/settings/edit_identity.inc

@@ -89 +89 @@
   // Enable TinyMCE editor
   if ($IDENTITY_RECORD['html_signature']) {
-    $form['signature']['content']['signature']['class'] = 'mce_editor';
+    $form['signature']['content']['signature']['class']      = 'mce_editor';
+    $form['signature']['content']['signature']['is_escaped'] = true;
   }