amorfo77/sogo
1
0
Fork 0
mirror of https://github.com/inverse-inc/sogo.git synced 2026-07-14 21:04:53 +00:00
Code Issues Projects Releases Wiki Activity

Fix encoding of HTML attributes in Contacts module

Browse Source
This commit is contained in:
Francis Lachapelle
2016-06-09 11:32:46 -04:00
parent 827d1d72c8
commit 636af7da5a
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
NEWS
+1
View File
@@ -7,6 +7,7 @@ Bug fixes
- [eas] when using EAS/ItemOperations, use IMAP PEEK operation
- [web] fixed recipients when replying from a message in the Sent mailbox (#2625)
- [web] fixed localizable strings in Card viewer
- [web] properly encode HTML attributes in Contacts module to avoid XSS issues
2.3.11 (2016-05-12)
-------------------
UI/Templates/ContactsUI/UIxContactFoldersView.wox
+4 -4
View File
@@ -151,11 +151,11 @@
<var:foreach list="personalContactInfos" item="currentContact">
<tr var:class="currentContactClasses"
var:categories="currentContact.c_categories.asSafeJSString"
var:categories="currentContact.c_categories.safeStringByEscapingXMLString"
var:id="currentContact.c_name.asCSSIdentifier"
var:contactname="currentContact.c_cn.asSafeJSString">
<td class="displayName" var:title="currentContact.c_cn.asSafeJSString"><var:string value="currentContact.c_cn" const:escapeHTML="YES" /></td>
<td var:title="currentContact.c_mail.asSafeJSString"><var:string value="currentContact.c_mail"/></td>
var:contactname="currentContact.c_cn.safeStringByEscapingXMLString">
<td class="displayName" var:title="currentContact.c_cn.safeStringByEscapingXMLString"><var:string value="currentContact.c_cn" const:escapeHTML="YES" /></td>
<td var:title="currentContact.c_mail.safeStringByEscapingXMLString"><var:string value="currentContact.c_mail"/></td>
<td><var:string value="currentContact.c_screenname"/></td>
<td><var:string value="currentContact.c_o"/></td>
<td><var:string value="currentContact.c_telephonenumber"/></td>