Philip Weir 2 days ago
committed by GitHub
parent
commit
38053ab034
No known key found for this signature in database GPG Key ID: B5690EEEBB952194
  1. 10
      program/include/rcmail_output_html.php

10
program/include/rcmail_output_html.php

@ -992,7 +992,11 @@ class rcmail_output_html extends rcmail_output
*/ */
protected function fix_paths($output) protected function fix_paths($output)
{ {
$regexp = '!(src|href|background|data-src-[a-z]+)=(["\']?)([a-z0-9/_.?=-]+)(["\'\s>])!i';
$regexp = [
'%(?P<name>src|background|data-src-[a-z]+)=(?P<opener>["\']?)(?P<file>[a-z0-9/_.?=-]+)(?P<closer>["\'\s>])%i',
// use dedicated pattern for href attribute to avoid <a>'s (#9941)
'%(?P<prefix><(?!a\s)[^>]*)(?P<name>href)=(?P<opener>["\']?)(?P<file>[a-z0-9/_.?=-]+)(?P<closer>["\'\s>])%i',
];
return preg_replace_callback($regexp, [$this, 'file_callback'], $output); return preg_replace_callback($regexp, [$this, 'file_callback'], $output);
} }
@ -1004,7 +1008,7 @@ class rcmail_output_html extends rcmail_output
*/ */
protected function file_callback($matches) protected function file_callback($matches)
{ {
$file = $matches[3];
$file = $matches['file'];
$file = preg_replace('!^/this/!', '/', $file); $file = preg_replace('!^/this/!', '/', $file);
// correct absolute paths // correct absolute paths
@ -1020,7 +1024,7 @@ class rcmail_output_html extends rcmail_output
$file = $this->resource_location($file); $file = $this->resource_location($file);
return $matches[1] . '=' . $matches[2] . $file . $matches[4];
return ($matches['prefix'] ?? '') . $matches['name'] . '=' . $matches['opener'] . $file . $matches['closer'];
} }
/** /**

Loading…
Cancel
Save