Added a conversion from < to &lt; when viewing "non-HTML" email for

security reasons.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@1486 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/functions/mime.php b/functions/mime.php
index a347425bb4a4baf04f9cbafdc006f7f09445ba35..278c0d95f429ab9b3968ae07ed05641b45ca3599 100644 (file)
--- a/functions/mime.php
+++ b/functions/mime.php
@@ -679,6 +679,8 @@
       $body = str_replace("\r\n", "\n", $body);
       $encoding = strtolower($encoding);
 
+      global $show_html_default;
+
       if ($encoding == "quoted-printable") {
          $body = quoted_printable_decode($body);
 
@@ -688,6 +690,13 @@
          $body = base64_decode($body);
       }
 
+      if (!$show_html_default) {
+         $body = str_replace('<', '&lt;', $body);
+//         $body = str_replace('>', '&gt;', $body);
+// Both this and $body = htmlspecialchars($body); mess up inline
+//  quoting :-(  Anyway, just replacing < gets the job done.
+      }
+
       // All other encodings are returned raw.
       return $body;
    }