mirror of
https://github.com/inverse-inc/sogo.git
synced 2026-08-18 05:03:20 +00:00
fix(mail): escape angularJS directive for description
This commit is contained in:
@@ -61,7 +61,7 @@
|
||||
request = [context request];
|
||||
params = [[request contentAsString] objectFromJSONString];
|
||||
|
||||
name = [[params objectForKey: @"name"] stringWithoutHTMLInjection: YES];
|
||||
name = [[params objectForKey: @"name"] stringWithoutHTMLInjection: YES stripAngular:NO];
|
||||
nameInContainer = nil;
|
||||
|
||||
if ([name length] > 0)
|
||||
|
||||
@@ -485,7 +485,7 @@ static Class SOGoContactGCSEntryK = Nil;
|
||||
co = [self clientObject];
|
||||
card = [co vCard];
|
||||
request = [context request];
|
||||
params = [[[request contentAsString] stringWithoutHTMLInjection: YES] objectFromJSONString];
|
||||
params = [[[request contentAsString] stringWithoutHTMLInjection: YES stripAngular:NO] objectFromJSONString];
|
||||
forceSave = [[params objectForKey: @"ignoreDuplicate"] boolValue];
|
||||
|
||||
[self setAttributes: params];
|
||||
|
||||
@@ -339,7 +339,7 @@
|
||||
[list retain];
|
||||
|
||||
request = [context request];
|
||||
params = [[[request contentAsString] stringWithoutHTMLInjection: YES] objectFromJSONString];
|
||||
params = [[[request contentAsString] stringWithoutHTMLInjection: YES stripAngular:NO] objectFromJSONString];
|
||||
|
||||
o = [params objectForKey: @"refs"];
|
||||
if (![o isKindOfClass: [NSArray class]])
|
||||
|
||||
@@ -587,7 +587,7 @@
|
||||
|
||||
//Sanitise the html content
|
||||
if([d objectForKey:@"content"]){
|
||||
[d setObject: [[d objectForKey:@"content"] stringWithoutHTMLInjection: NO] forKey: @"content"];
|
||||
[d setObject: [[d objectForKey:@"content"] stringWithoutHTMLInjection: NO stripAngular:YES] forKey: @"content"];
|
||||
}
|
||||
|
||||
return d;
|
||||
|
||||
@@ -201,7 +201,7 @@
|
||||
|
||||
|
||||
|
||||
content = [[[self generateResponse] contentAsString] stringWithoutHTMLInjection: NO];
|
||||
content = [[[self generateResponse] contentAsString] stringWithoutHTMLInjection: NO stripAngular:YES];
|
||||
if ([self respondsToSelector:@selector(getException)]) {
|
||||
e = [self getException];
|
||||
}
|
||||
|
||||
@@ -79,7 +79,7 @@
|
||||
|
||||
request = [context request];
|
||||
params = [[request contentAsString] objectFromJSONString];
|
||||
folderName = [[params objectForKey: @"name"] stringWithoutHTMLInjection: YES];
|
||||
folderName = [[params objectForKey: @"name"] stringWithoutHTMLInjection: YES stripAngular:NO];
|
||||
if ([folderName length] > 0)
|
||||
{
|
||||
encodedFolderName = [folderName stringByEncodingImap4FolderName];
|
||||
@@ -145,7 +145,7 @@
|
||||
// Retrieve new folder name from JSON payload
|
||||
request = [context request];
|
||||
params = [[request contentAsString] objectFromJSONString];
|
||||
newFolderName = [[params objectForKey: @"name"] stringWithoutHTMLInjection: YES];
|
||||
newFolderName = [[params objectForKey: @"name"] stringWithoutHTMLInjection: YES stripAngular:NO];
|
||||
|
||||
if (!newFolderName || [newFolderName length] == 0)
|
||||
{
|
||||
|
||||
@@ -1178,7 +1178,7 @@
|
||||
[msg addObject: [NSNumber numberWithBool: [self isMessageFlagged]]];
|
||||
|
||||
// Subject
|
||||
[msg addObject: [[[self messageSubject] stringWithoutHTMLInjection: YES] stringWithoutHTMLInjection: NO]];
|
||||
[msg addObject: [[[self messageSubject] stringWithoutHTMLInjection: YES stripAngular:NO] stringWithoutHTMLInjection: NO stripAngular:NO]];
|
||||
|
||||
// From
|
||||
from = [[message objectForKey: @"envelope"] from];
|
||||
|
||||
@@ -363,7 +363,7 @@ static NSString *mailETag = nil;
|
||||
if ([self formattedDate])
|
||||
[data setObject: [self formattedDate] forKey: @"date"];
|
||||
if ([self messageSubject])
|
||||
[data setObject: [[[self messageSubject] stringWithoutHTMLInjection: YES] stringWithoutHTMLInjection: NO] forKey: @"subject"];
|
||||
[data setObject: [[[self messageSubject] stringWithoutHTMLInjection: YES stripAngular:YES] stringWithoutHTMLInjection: NO stripAngular:YES] forKey: @"subject"];
|
||||
if ((addresses = [addressFormatter dictionariesForArray: [co fromEnvelopeAddresses]]))
|
||||
[data setObject: addresses forKey: @"from"];
|
||||
if ((addresses = [addressFormatter dictionariesForArray: [co toEnvelopeAddresses]]))
|
||||
|
||||
@@ -1091,7 +1091,7 @@ static const NSString *kJwtKey = @"jwt";
|
||||
}
|
||||
|
||||
//Check common injection
|
||||
loginClean = [login stringWithoutHTMLInjection: YES];
|
||||
loginClean = [login stringWithoutHTMLInjection: YES stripAngular:NO];
|
||||
if(![loginClean isEqualToString: login])
|
||||
{
|
||||
loginClean = @"";
|
||||
|
||||
@@ -1750,7 +1750,7 @@ static NSArray *reminderValues = nil;
|
||||
id o, v;
|
||||
|
||||
requestStr = [[context request] contentAsString];
|
||||
requestStr = [requestStr stringWithoutHTMLInjection: NO];
|
||||
requestStr = [requestStr stringWithoutHTMLInjection: NO stripAngular:NO];
|
||||
o = [requestStr objectFromJSONString];
|
||||
results = nil;
|
||||
|
||||
|
||||
@@ -403,7 +403,7 @@ static SoProduct *commonProduct = nil;
|
||||
theme = [[context request] formValueForKey: @"theme"];
|
||||
if ([theme length])
|
||||
{
|
||||
safeTheme = [theme stringWithoutHTMLInjection: YES];
|
||||
safeTheme = [theme stringWithoutHTMLInjection: YES stripAngular:NO];
|
||||
if([safeTheme isEqualToString: theme])
|
||||
rel = [NSString stringWithFormat: @"%@?theme=%@", rel, theme];
|
||||
}
|
||||
|
||||
@@ -556,7 +556,7 @@
|
||||
|
||||
ex = nil;
|
||||
request = [context request];
|
||||
params = [[[request contentAsString] stringWithoutHTMLInjection: NO] objectFromJSONString];
|
||||
params = [[[request contentAsString] stringWithoutHTMLInjection: NO stripAngular:NO] objectFromJSONString];
|
||||
if (params == nil)
|
||||
{
|
||||
ex = [NSException exceptionWithName: @"JSONParsingException"
|
||||
|
||||
@@ -182,7 +182,7 @@ _intValueFromHex (NSString *hexString)
|
||||
fActiveTasks = [folder activeTasks];
|
||||
|
||||
[calendar setObject: folderName forKey: @"id"];
|
||||
[calendar setObject: [fDisplayName stringWithoutHTMLInjection: YES] forKey: @"name"];
|
||||
[calendar setObject: [fDisplayName stringWithoutHTMLInjection: YES stripAngular:NO] forKey: @"name"];
|
||||
[calendar setObject: [folder calendarColor] forKey: @"color"];
|
||||
isActive = [NSNumber numberWithBool: [folder isActive]];
|
||||
[calendar setObject: isActive forKey: @"active"];
|
||||
|
||||
@@ -335,7 +335,7 @@
|
||||
|
||||
ex = nil;
|
||||
request = [context request];
|
||||
params = [[[request contentAsString] stringWithoutHTMLInjection: NO] objectFromJSONString];
|
||||
params = [[[request contentAsString] stringWithoutHTMLInjection: NO stripAngular:NO] objectFromJSONString];
|
||||
if (params == nil)
|
||||
{
|
||||
ex = [NSException exceptionWithName: @"JSONParsingException"
|
||||
|
||||
@@ -299,7 +299,7 @@
|
||||
<label class="pseudo-input-label">
|
||||
<var:string label:value="Description"/>
|
||||
</label>
|
||||
<div>
|
||||
<div ng-non-bindable="">
|
||||
<md-content>
|
||||
<var:string value="authorativeEvent.comment.stringByDetectingURLs" const:insertBR="1" const:escapeHTML="NO"/>
|
||||
</md-content>
|
||||
|
||||
Reference in New Issue
Block a user