Changeset 1231 in subversion


Ignore:
Timestamp:
Apr 2, 2008 8:08:12 AM (5 years ago)
Author:
thomasb
Message:

Remove evil css styles like expression() in HTML messages

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/roundcubemail/program/include/main.inc

    r1201 r1231  
    13781378/** 
    13791379 * Replace all css definitions with #container [def] 
     1380 * and remove css-inlined scripting 
    13801381 * 
    13811382 * @param string CSS source code 
    … …  
    13871388  $a_css_values = array(); 
    13881389  $last_pos = 0; 
     1390   
     1391  // ignore the whole block if evil styles are detected 
     1392  if (stristr($source, 'expression') || stristr($source, 'behavior')) 
     1393    return ''; 
    13891394 
    13901395  // cut out all contents between { and } 
    … …  
    13971402  } 
    13981403 
    1399   // remove html commends and add #container to each tag selector. 
     1404  // remove html comments and add #container to each tag selector. 
    14001405  // also replace body definition because we also stripped off the <body> tag 
    14011406  $styles = preg_replace( 
Note: See TracChangeset for help on using the changeset viewer.