mirror of
https://github.com/inverse-inc/sogo.git
synced 2026-08-29 02:07:36 +00:00
Jan Kahmen
045a0b9c0a
the generic attribute writer used for these two spots does not escape what it writes, so a value taken from the message ends the attribute and starts a new one. both are inside a part that is compiled, which is where an injected handler runs. * the organizer link took inEvent.organizer.email verbatim. a value such as mailto:x@y" onpointerover="... produced a live handler on the anchor, and an entity encoded scheme such as javascript: reached the href, where the browser decodes it. the href is now built as mailto: plus the parsed address and escaped as an attribute value. * the attachment name paragraph of the image and the link viewer took filenameForDisplay verbatim. a quote inside an RFC 2231 encoded filename ended the title attribute. the writer escapes & < > there but not the quote, so the accessor drops the quote instead of escaping it, which keeps a plain filename such as A&B.pdf unchanged in the tooltip. the img title of the image viewer is left alone: attributes of that element are escaped by the framework already.
28 lines
985 B
XML
28 lines
985 B
XML
<?xml version="1.0" standalone="yes"?>
|
|
<!DOCTYPE div>
|
|
<container
|
|
xmlns="http://www.w3.org/1999/xhtml"
|
|
xmlns:var="http://www.skyrix.com/od/binding"
|
|
xmlns:const="http://www.skyrix.com/od/constant"
|
|
xmlns:label="OGo:label"
|
|
>
|
|
<md-card>
|
|
<img var:src="pathToAttachment"
|
|
var:title="filenameForDisplay"><!-- image --></img>
|
|
<md-card-content>
|
|
<p class="md-caption" var:title="filenameForTitle">
|
|
<var:string value="filenameForDisplay" />
|
|
</p>
|
|
</md-card-content>
|
|
<md-dialog-actions layout="row" layout-align="start center">
|
|
<div class="md-flex sg-attachment-size">
|
|
<var:string value="bodyInfo.size" formatter="sizeFormatter"/>
|
|
</div>
|
|
<md-button class="sg-icon-button" var:href="pathForDownload">
|
|
<md-tooltip md-direction="left"><var:string label:value="Save Attachment"/></md-tooltip>
|
|
<md-icon>file_download</md-icon>
|
|
</md-button>
|
|
</md-dialog-actions>
|
|
</md-card>
|
|
</container>
|