Commits · 013080997b4bfa054f4493e66cd431470f816443 · docker / osticket

Sep 29, 2014

bug: Decode mailbox when parsing an email address · eb471134

Peter Rotich authored 10 years ago

This addresses cases where incoming emails doesn't include charset and
mailbox may include non-ascii characters.

eb471134

Jul 30, 2014
- Fix potential XSS vulnerability on user's name · 17d5dbf5
  Jared Hancock authored 10 years ago
```
Add other locations as well a failsafe for the htmlentities() call
```
  17d5dbf5
Jul 17, 2014

Fix XSS vulnerability on user's name · 92824412

Peter Rotich authored 10 years ago

Names parsed from incoming emails are stored in the database as is. This
pull request addresses potential XSS vulnerability due to improper display
of unsanitized names. Going forward names will be scrubbed on create.

92824412

Jun 10, 2014
- Add JSON encoder utility to Format class · d50dca8a
  Peter Rotich authored 10 years ago
  
  d50dca8a
May 21, 2014

Fix external image in an inline <a> element · 99e719d9

Jared Hancock authored 10 years ago

htmLawed stripped/discarded <div> tags nested inside inline tags such as
<a>. The previous replacement engine would replace <img> tags with <div>
tags and would cause the HTML to be corrupted by htmLawed.

This patch uses <span> tags which have CSS rules to be displayed as
inline-blocks. This should stay truer to the normal sizing and placement of
the original <img> tag.

99e719d9

May 13, 2014

html: Remove duplicate style properties · b3bb64c3

Jared Hancock authored 10 years ago

Also use single quotes instead of double quotes in style attributes which
do not require escaping to &quot;

b3bb64c3

May 07, 2014
- Strip leading and trailing WS from text mails · fa7a0255
  Jared Hancock authored 10 years ago
  
  fa7a0255
Apr 18, 2014
- html: Trim space around `;` in @style attributes · ed2b2c68
  Jared Hancock authored 10 years ago
  
  ed2b2c68
Apr 16, 2014

html: Avoid corrupting quoted style attributes · 1f625787

Jared Hancock authored 10 years ago

For instance, current this style we be converted as
```
<span style="font-family:'courier new';">
```
to
```
<span style="font-family:&quot;">
```

Also discard Microsoft Office specific style attributes such as `mso-list`
and friends

1f625787

Apr 15, 2014
- pjax: Fix external links not to use PJAX · 299dae40
  Jared Hancock authored 10 years ago
  
  299dae40
Apr 09, 2014
- Honor thread body format in PDF export · 67ae49cf
  Jared Hancock authored 10 years ago
  
  67ae49cf
Mar 13, 2014

html: Be careful not to strip too much · fb4f01ca

Jared Hancock authored 11 years ago

If there is content between to <style> elements, the content was previously
stripped by Format::safe_html function. This patch adjusts the regex to
strip tags such as <head>, <script> and <style> so that if content is found
between two of them, it will be preserved.

fb4f01ca

Feb 28, 2014
- html: Drop xml processing instructions from email · d1621357
  Jared Hancock authored 11 years ago
  
  d1621357
Feb 20, 2014

Place the message-id in the body of the email · f954d69f

Jared Hancock authored 11 years ago

This approach will help detect responses to the ticket thread from mail
clients which do not include the References and In-Reply-To MIME headers.
This also allows the Subject line to continue to omit the ticket number.

f954d69f

Feb 10, 2014

Assume ISO-8859-1 when charset is unknown or bogus · 35882c06

Peter Rotich authored 11 years ago

Unfortunately, this is necessary because some mail clients send in content without defining
the charset or at worse using freaking wrong/invalid charsets like
'default'!

35882c06

Feb 05, 2014
- Encode the text even when target encoding is the same as charset · 4a67fa3b
  Peter Rotich authored 11 years ago
```
This is needed to help us remove invalid characters set by some mail
clients.
```
  4a67fa3b
- oops: Fix regex error in cid: matching · acfc421b
  Jared Hancock authored 11 years ago
  
  acfc421b
Jan 30, 2014
- Prepend `http://` to links starting with `www.` · d9e564d2
  Jared Hancock authored 11 years ago
  
  d9e564d2
- oops: Make files viewable with _ in key · e0c7e4b6
  Jared Hancock authored 11 years ago
  
  e0c7e4b6
- html: PHP DomDocument classes are in the `dom` ext · b7eb9ebd
  Jared Hancock authored 11 years ago
  
  b7eb9ebd
- i18n: Remove unused, possibly incorrect formatting · 78742c71
  Jared Hancock authored 11 years ago
```
These functions don't appear to be used an could corrupt UTF-8 encoded text
```
  78742c71
Jan 29, 2014
- Fix mailto: links to not route through l.php · 540f1bb0
  Jared Hancock authored 11 years ago
  
  540f1bb0
- Fix clickable links which end in punctuation · 1fbcb8fd
  Jared Hancock authored 11 years ago
  
  1fbcb8fd
Nov 21, 2013
- html: Fix normalization of stuff like <html> · 25250140
  Jared Hancock authored 11 years ago
  
  25250140
Nov 20, 2013

html: Reduce dependency on htmlchars · 2f62149d

Jared Hancock authored 11 years ago

Previously, html-like content would have to be run through Format::htmlchars
before being passed to Format::sanitize, because things that looked like
invalid html content would be removed.

2f62149d

Nov 19, 2013
- email: drop <!DOCTYPE ...> strings from email body · 86b0bcde
  Jared Hancock authored 11 years ago
  
  86b0bcde
Nov 15, 2013
- Make max_upload_filesize a drop-down list · 53ce5272
  Jared Hancock authored 11 years ago
  
  53ce5272
Nov 14, 2013
- Remove old or unnecessary configuration settings · c21dac64
  Jared Hancock authored 11 years ago
  
  c21dac64
- External URLs need to route through l.php · 782382bd
  Jared Hancock authored 11 years ago
```
This include URLs in embedded links as well as URLs for external images and
videos embedded via iframe elements.
```
  782382bd
Nov 01, 2013

Allow embedding videos via <iframes> · 8d01fcac

Jared Hancock authored 11 years ago

Also ensure that the ticket thread is displayed in a <div> container as some
browsers seems to frown upon <iframe>s in <td> elements

Fixes #75

8d01fcac

Oct 31, 2013
- Fix oops in htmLawd callback for HTML cleanup · 3aef3562
  Jared Hancock authored 11 years ago
  
  3aef3562
- Fix oops in HTML cleanup helper decl · c6b12155
  Jared Hancock authored 11 years ago
  
  c6b12155
Oct 29, 2013

Remove <![if !mso]> tags and friends · e97bef0c

Jared Hancock authored 11 years ago

Also remove CSS properties from the style attribute that are browser
specific (like -webkit-* and such)

e97bef0c

Oct 25, 2013
- Use <pre> elements for text emails · 65224786
  Jared Hancock authored 11 years ago
```
This provides better compatibility with mPDF, which doesn't support the CSS
white-space:pre-wrap property
```
  65224786
- Remove "# nolint" comments where at all possible · 1b89058f
  Jared Hancock authored 11 years ago
  
  1b89058f
Oct 23, 2013
- Fix syntax error :( · a2109a0d
  Peter Rotich authored 11 years ago
  
  a2109a0d
- User html2html wrapper · f76ced57
  Peter Rotich authored 11 years ago
  
  f76ced57
- Decouple osTicket specific logic from html2text module · 8b306c76
  Peter Rotich authored 11 years ago
```
Fix preg_replace bugs
```
  8b306c76
Oct 22, 2013

Correct implementation and description of API · d340ee15

Jared Hancock authored 11 years ago

Allow for type and encoding specification of the message body and better
describe the integration with custom form fields.

d340ee15

Oct 21, 2013

Remove <style> and <head> elements · 89fddceb

Jared Hancock authored 11 years ago

Upgrade to htmLawed 1.1.16

Remove @id attributes as they could confuse existing id attributes used for
styling and javascript.

Remove @class attributes except for standard ones used by Microsoft® office
which have entries in our thread stylesheet.

89fddceb