|
|
@@ -540,7 +540,11 @@ function buildAttachmentArray($message, $exclude_id, $mailbox, $id) {
|
|
|
if ($where && $what) {
|
|
|
$defaultlink .= '&where='. urlencode($where).'&what='.urlencode($what);
|
|
|
}
|
|
|
-
|
|
|
+ // IE does make use of mime content sniffing. Forcing a download
|
|
|
+ // prohibit execution of XSS inside an application/octet-stream attachment
|
|
|
+ if ($type0 == 'application' && $type1 == 'octet-stream') {
|
|
|
+ $defaultlink .= '&absolute_dl=true';
|
|
|
+ }
|
|
|
/* This executes the attachment hook with a specific MIME-type.
|
|
|
* If that doesn't have results, it tries if there's a rule
|
|
|
* for a more generic type. Finally, a hook for ALL attachment
|
|
|
@@ -1695,12 +1699,66 @@ function sq_fixatts($tagname,
|
|
|
function sq_fixstyle($body, $pos, $message, $id, $mailbox){
|
|
|
global $view_unsafe_images;
|
|
|
$me = 'sq_fixstyle';
|
|
|
- $ret = sq_findnxreg($body, $pos, '</\s*style\s*>');
|
|
|
- if ($ret == FALSE){
|
|
|
+
|
|
|
+ // workaround for </style> in between comments
|
|
|
+ $iCurrentPos = $pos;
|
|
|
+ $content = '';
|
|
|
+ $sToken = '';
|
|
|
+ $bSucces = false;
|
|
|
+ $bEndTag = false;
|
|
|
+ for ($i=$pos,$iCount=strlen($body);$i<$iCount;++$i) {
|
|
|
+ $char = $body{$i};
|
|
|
+ switch ($char) {
|
|
|
+ case '<':
|
|
|
+ $sToken .= $char;
|
|
|
+ break;
|
|
|
+ case '/':
|
|
|
+ if ($sToken == '<') {
|
|
|
+ $sToken .= $char;
|
|
|
+ $bEndTag = true;
|
|
|
+ } else {
|
|
|
+ $content .= $char;
|
|
|
+ }
|
|
|
+ break;
|
|
|
+ case '>':
|
|
|
+ if ($bEndTag) {
|
|
|
+ $sToken .= $char;
|
|
|
+ if (preg_match('/\<\/\s*style\s*\>/i',$sToken,$aMatch)) {
|
|
|
+ $newpos = $i + 1;
|
|
|
+ $bSucces = true;
|
|
|
+ break 2;
|
|
|
+ } else {
|
|
|
+ $content .= $sToken;
|
|
|
+ }
|
|
|
+ $bEndTag = false;
|
|
|
+ } else {
|
|
|
+ $content .= $char;
|
|
|
+ }
|
|
|
+ break;
|
|
|
+ case '!':
|
|
|
+ if ($sToken == '<') {
|
|
|
+ // possible comment
|
|
|
+ if (isset($body{$i+2}) && substr($body,$i,3) == '!--') {
|
|
|
+ $i = strpos($body,'-->',$i+3);
|
|
|
+ $sToken = '';
|
|
|
+ }
|
|
|
+ } else {
|
|
|
+ $content .= $char;
|
|
|
+ }
|
|
|
+ break;
|
|
|
+ default:
|
|
|
+ if ($bEndTag) {
|
|
|
+ $sToken .= $char;
|
|
|
+ } else {
|
|
|
+ $content .= $char;
|
|
|
+ }
|
|
|
+ break;
|
|
|
+ }
|
|
|
+ }
|
|
|
+ if ($bSucces == FALSE){
|
|
|
return array(FALSE, strlen($body));
|
|
|
}
|
|
|
- $newpos = $ret[0] + strlen($ret[2]);
|
|
|
- $content = $ret[1];
|
|
|
+
|
|
|
/**
|
|
|
* First look for general BODY style declaration, which would be
|
|
|
* like so:
|
|
|
@@ -2389,11 +2447,15 @@ function SendDownloadHeaders($type0, $type1, $filename, $force, $filesize=0) {
|
|
|
|
|
|
// This works for most types, but doesn't work with Word files
|
|
|
header ("Content-Type: application/download; name=\"$filename\"");
|
|
|
-
|
|
|
+ // This is to prevent IE for MIME sniffing and auto open a file in IE
|
|
|
+ header ("Content-Type: application/force-download; name=\"$filename\"");
|
|
|
// These are spares, just in case. :-)
|
|
|
//header("Content-Type: $type0/$type1; name=\"$filename\"");
|
|
|
//header("Content-Type: application/x-msdownload; name=\"$filename\"");
|
|
|
//header("Content-Type: application/octet-stream; name=\"$filename\"");
|
|
|
+ } else if ($isIE) {
|
|
|
+ // This is to prevent IE for MIME sniffing and auto open a file in IE
|
|
|
+ header ("Content-Type: application/force-download; name=\"$filename\"");
|
|
|
} else {
|
|
|
// another application/octet-stream forces download for Netscape
|
|
|
header ("Content-Type: application/octet-stream; name=\"$filename\"");
|
Thijs Kinkhorst