6.0.0-beta1
▾
Tasks
New Task
Search
Photos
Wiki
▾
Tickets
New Ticket
Search
dev.horde.org
Toggle Alerts Log
Help
7/24/25
H
istory
A
ttachments
C
omment
W
atch
Download
Comment on [#7926] Message option "Show All Headers" causes error
*
Your Email Address
*
Spam protection
Enter the letters below:
.__. ..__ .___._. [__] |[ __[__ | | |\__|[_./[____|_
Comment
>> AFAICT, selfUrl() (as called by message.php) has the $full param set > >> to false; in selfUrl, Horde::url() is called with $full = false; and > >> the URL will necessarily have '&' param separators, instead of '&' > >> separators so htmlentities() will be called on the generated URL at > >> the bottom of url(). Thus, anything appearing in the URL will/should > >> be escaped. > > > > Okay, this is unintuitive, but I follow you and agree - though > looking at Horde::url(), at the very bottom of the function, couldn't > you trick it into not encoding the URL by passing & for one > parameter, and raw data in another? > > > >> As for smime.php, we should probably use > >> htmlspecialchars(html_entity_decode(Util::getFormData('reload'))) > >> instead of htmlspecialchars(Util::getFormData('reload')) (we use the > >> former elsewhere in that file). Looks like we aren't doing the > >> html_entity_decode() call in pgp.php in either place we are > >> processing 'reload' form data, so we should probably be doing that. > > > > If we already do that in those files, that seems fine.
Attachment
Watch this ticket
N
ew Ticket
M
y Tickets
S
earch
Q
uery Builder
R
eports
Saved Queries
Open Bugs
Bugs waiting for Feedback
Open Bugs in Releases
Open Enhancements
Enhancements waiting for Feedback
Bugs with Patches
Enhancements with Patches
Release Showstoppers
Stalled Tickets
New Tickets
Horde 5 Showstoppers