6.0.0-beta1
▾
Tasks
New Task
Search
Photos
Wiki
▾
Tickets
New Ticket
Search
dev.horde.org
Toggle Alerts Log
Help
10/22/25
H
istory
A
ttachments
C
omment
W
atch
Download
Comment on [#7926] Message option "Show All Headers" causes error
*
Your Email Address
*
Spam protection
Enter the letters below:
.__..___.___. ..__ | |[__ [__ |_/ [__) |__|| [___| \[__)
Comment
>>> You are right about the '&' trick - it is possible to put a > >>> superfluous one in an URL and it will skip the htmlentities() call. > >> > >> For what we do here, do you agree that escapeOnce (from > >> http://cvs.horde.org/co.php/framework/View/lib/Horde/View/Helper/Url.php?r=ccfd50278baa306abee1acd1b310a168f8ae4925) would >> work > >> instead? > > > > Not really following that code without any real-life context. But > theoretically, we really shouldn't be "fixing" double escaped > parameters when parsing a URL from form data. If double escaped > parameters exist at that point, either the generating code is broken > and should be fixed or something fishy is occurring. It might be > best to ignore those URLs completely and throw an exception or error > rather than trying to magically fix it.
Attachment
Watch this ticket
N
ew Ticket
M
y Tickets
S
earch
Q
uery Builder
R
eports
Saved Queries
Open Bugs
Bugs waiting for Feedback
Open Bugs in Releases
Open Enhancements
Enhancements waiting for Feedback
Bugs with Patches
Enhancements with Patches
Release Showstoppers
Stalled Tickets
New Tickets
Horde 5 Showstoppers