Changeset 1036 for trunk/expressoMail1_2/inc/class.imap_functions.inc.php

Timestamp:

06/22/09 09:47:02 (15 years ago)

Author:

amuller

Message:

Ticket #559 - Atualização de segurança

File:

• trunk/expressoMail1_2/inc/class.imap_functions.inc.php (modified) (3 diffs)

trunk/expressoMail1_2/inc/class.imap_functions.inc.php

@@ -1 +1 @@
 <?php
+        $GLOBALS['phpgw_info']['flags'] = array(
+                'currentapp' => 'expressoMail1_2',
+                'nonavbar'   => true,
+                'noheader'   => true
+        );
+
+        require_once $_SERVER[ 'DOCUMENT_ROOT' ] . '/header.inc.php';
 include_once("class.functions.inc.php");
 include_once("class.ldap_functions.inc.php");
@@ -1000 +1007 @@
                 }
                 // Malicious Code Remove
-                $dirtyCodePattern = "/(<([\w]+)([^>]*)on(mouse(move|over|down|up)|load|blur|change|click|dblclick|focus|key(down|up|press)|select)=[\"'][^>\"']*[\"']([^>]*)>)(.*)(<\/\\2>)?/isU";
+                $dirtyCodePattern = "/(<([\w]+[\w0-9]*)([^>]*)on(mouse(move|over|down|up)|load|blur|change|click|dblclick|focus|key(down|up|press)|select)(\ *)=(\ *)[\"'][^>\"']*[\"']([^>]*)>)(.*)(<\/\\2>)?/misU";
                 preg_match_all($dirtyCodePattern,$body,$rest,PREG_PATTERN_ORDER);
                 foreach($rest[0] as $i => $val)
-                        if (!(preg_match("/window\.open/i",$rest[1][$i]) && strtoupper($rest[4][$i]) == "CLICK" )) //Calendar events
+                        if (!(preg_match("/javascript:window\.open\(\"\/index\.php\?menuaction=calendar\.uicalendar\.set_action\&cal_id=([^;'\"]+);?['\"]/i",$rest[1][$i]) && strtoupper($rest[4][$i]) == "CLICK" )) //Calendar events
                                 $body = str_replace($rest[1][$i],"<".$rest[2][$i].$rest[3][$i].$rest[7][$i].">",$body);
 
@@ -1013 +1020 @@
                 // Verify exception.
                 @preg_match("/<a href=\"notes:\/\/\//",$body,$matches);
-                // It no has exception,then open the link in new window.
+                // If there is no exception,then open the link in new window.
                 if(count($matches))
                         return $body;