Tickets :: [#3735] Inline HTML shows partial message

6.0.0-beta1

11/13/25

Summary	Inline HTML shows partial message
Queue	IMP
Queue Version	4.1
Type	Bug
State	Not A Bug
Priority	1. Low
Owners
Requester	phyre (at) rogers (dot) com
Created	04/03/2006 (7164 days ago)
Due
Updated	04/04/2006 (7163 days ago)
Assigned
Resolved	04/03/2006 (7164 days ago)
Github Issue Link
Github Pull Request
Milestone
Patch	No

04/04/2006 03:07:40 AM	Chuck Hagenbuch	Comment #4	Reply to this comment
I'm not inclined to muck around with trying to merge two bodies. They're seperate HTML documents, even - pretty easy to imagine being able to use that to sneak something by the XSS parser.

04/03/2006 10:49:54 PM	phyre (at) rogers (dot) com	Comment #3	Reply to this comment
That HTML part has two <html> sections and more importantly each has their own <body>. Our XSS filter only allows the last <body> section. Shouldn't they be merged into one then? If this is what exchange is producing with signatures should horde be able to read it?

04/03/2006 08:58:08 PM	Chuck Hagenbuch	Comment #2 State ⇒ Not A Bug	Reply to this comment
That HTML part has two <html> sections and more importantly each has their own <body>. Our XSS filter only allows the last <body> section.

04/03/2006 08:55:59 PM	phyre (at) rogers (dot) com	Comment #1 State ⇒ Unconfirmed Priority ⇒ 1. Low Type ⇒ Bug Summary ⇒ Inline HTML shows partial message Queue ⇒ IMP New Attachment: partial_html_inline.txt	Reply to this comment
See the attached message (I mangled his signature and removed some of the headers). This message was generated from exchange. I often have trouble with this user, so it's not just this message, especially with attachments. Maybe this message can provide insight. If I make this a mail file on my server and view the text portion I have no problem (so I shortened the text portion). If I view the HTML portion inline (set inline = true for html), I see only his bolded signature. If I click on the 'view in a sperate window' link that's in the message, it opens the full message in the external e-mail. So I guess the question is why? Why is this message only partially displaying when displayed inline, but fully displaying when opened in a new window? The attachment problem was that the attachment wasn't showing up, but was if I downloaded all attachments. I'd imagine they're related somehow. Thoughts?