mirror of
https://github.com/inverse-inc/sogo.git
synced 2026-08-29 18:27:36 +00:00
Jan Kahmen
045a0b9c0a
the generic attribute writer used for these two spots does not escape what it writes, so a value taken from the message ends the attribute and starts a new one. both are inside a part that is compiled, which is where an injected handler runs. * the organizer link took inEvent.organizer.email verbatim. a value such as mailto:x@y" onpointerover="... produced a live handler on the anchor, and an entity encoded scheme such as javascript: reached the href, where the browser decodes it. the href is now built as mailto: plus the parsed address and escaped as an attribute value. * the attachment name paragraph of the image and the link viewer took filenameForDisplay verbatim. a quote inside an RFC 2231 encoded filename ended the title attribute. the writer escapes & < > there but not the quote, so the accessor drops the quote instead of escaping it, which keeps a plain filename such as A&B.pdf unchanged in the tooltip. the img title of the image viewer is left alone: attributes of that element are escaped by the framework already.
49 lines
2.1 KiB
XML
49 lines
2.1 KiB
XML
<?xml version="1.0" standalone="yes"?>
|
|
<!DOCTYPE div>
|
|
<container xmlns="http://www.w3.org/1999/xhtml"
|
|
xmlns:var="http://www.skyrix.com/od/binding"
|
|
xmlns:const="http://www.skyrix.com/od/constant"
|
|
xmlns:label="OGo:label">
|
|
<md-card>
|
|
<md-card-content>
|
|
<p class="md-caption sg-attachment-name" var:title="filenameForTitle">
|
|
<var:if condition="preferredPathExtension.length"><span class="sg-label-outline"><var:string value="preferredPathExtension"/></span></var:if>
|
|
<var:string value="filenameForDisplay"/>
|
|
</p>
|
|
</md-card-content>
|
|
<md-dialog-actions layout="row" layout-align="end center">
|
|
<div class="md-flex sg-attachment-size">
|
|
<var:string value="bodyInfo.size" formatter="sizeFormatter"/>
|
|
</div>
|
|
<var:if condition="pathToAttachment.length"><md-button class="sg-icon-button" var:href="pathToAttachment" target="_blank">
|
|
<md-tooltip md-direction="left"><var:string label:value="View Attachment"/></md-tooltip>
|
|
<md-icon>open_in_new</md-icon>
|
|
</md-button></var:if>
|
|
<md-button class="sg-icon-button" var:href="pathForDownload">
|
|
<md-tooltip md-direction="left"><var:string label:value="Save Attachment"/></md-tooltip>
|
|
<md-icon>file_download</md-icon>
|
|
</md-button>
|
|
</md-dialog-actions>
|
|
|
|
<!-- DEBUG
|
|
<pre><var:string value="bodyInfo"/></pre>
|
|
|
|
<a var:href="pathToAttachment"
|
|
var:title="bodyInfo"
|
|
class="mailer_imagecontent"
|
|
>[<var:string value="pathToAttachment" />]</a>
|
|
<br />
|
|
Id: <var:string value="bodyInfo.bodyId" /><br />
|
|
Desc: <var:string value="bodyInfo.description" /><br />
|
|
Enc: <var:string value="bodyInfo.encoding" /><br />
|
|
Par: <var:string value="bodyInfo.parameterList" /><br />
|
|
Size: <var:string value="bodyInfo.size" /><br />
|
|
Type: <var:string value="bodyInfo.type" /><br />
|
|
Subtype: <var:string value="bodyInfo.subtype" /><br />
|
|
Path: <var:string value="pathToAttachment" /><br />
|
|
PartPath: <var:string value="partPath" /><br />
|
|
-->
|
|
|
|
</md-card>
|
|
</container>
|