Tickets :: Comment on [#7926] Message option "Show All Headers" causes error

* Your Email Address
* Spam protection	Enter the letters below: .__. ..__ .___._. [__] \|[ __[__ \| \| \|\__\|[_./[____\|_
Comment	>> AFAICT, selfUrl() (as called by message.php) has the $full param set > >> to false; in selfUrl, Horde::url() is called with $full = false; and > >> the URL will necessarily have '&' param separators, instead of '&amp' > >> separators so htmlentities() will be called on the generated URL at > >> the bottom of url(). Thus, anything appearing in the URL will/should > >> be escaped. > > > > Okay, this is unintuitive, but I follow you and agree - though > looking at Horde::url(), at the very bottom of the function, couldn't > you trick it into not encoding the URL by passing & for one > parameter, and raw data in another? > > > >> As for smime.php, we should probably use > >> htmlspecialchars(html_entity_decode(Util::getFormData('reload'))) > >> instead of htmlspecialchars(Util::getFormData('reload')) (we use the > >> former elsewhere in that file). Looks like we aren't doing the > >> html_entity_decode() call in pgp.php in either place we are > >> processing 'reload' form data, so we should probably be doing that. > > > > If we already do that in those files, that seems fine.
Attachment
Watch this ticket