Tickets :: Comment on [#7926] Message option "Show All Headers" causes error

* Your Email Address
* Spam protection	Enter the letters below: .___. .. ..__ .__. [__ \ /\|\ \|[__)[__] [___ \/ \| \\|\| \\| \|
Comment	>> Right, it's not relevant for template evaluation, but > >> Horde::selfUrl() can contain raw query parameters, so those need to > >> be escaped somewhere along the way. I didn't see that happening > >> already, but if it is, then yes, the commits are irrelevant (and > >> incorrect). > > > > AFAICT, selfUrl() (as called by message.php) has the $full param set > to false; in selfUrl, Horde::url() is called with $full = false; and > the URL will necessarily have '&' param separators, instead of '&amp' > separators so htmlentities() will be called on the generated URL at > the bottom of url(). Thus, anything appearing in the URL will/should > be escaped. > > > > As for smime.php, we should probably use > htmlspecialchars(html_entity_decode(Util::getFormData('reload'))) > instead of htmlspecialchars(Util::getFormData('reload')) (we use the > former elsewhere in that file). Looks like we aren't doing the > html_entity_decode() call in pgp.php in either place we are > processing 'reload' form data, so we should probably be doing that. > > > > Does any of this sound sane/rational/correct?
Attachment
Watch this ticket