Mirrors/roundcubemail
2
0
Fork 0
mirror of https://github.com/roundcube/roundcubemail.git synced 2026-03-24 16:56:59 +01:00
Code Issues Packages Projects Releases Wiki Activity

Remove double-quotation prevention code for form elements

Browse Source
This commit is contained in:
Aleksander Machniak
2012-09-17 15:01:34 +02:00
parent 649cc19cfc
commit d66e50d6b5
1 changed files with 7 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
program/include/html.php
View File

@@ -295,7 +295,7 @@ class html
}
}
else {
$attrib_arr[] = $key . '="' . self::quote($value, true) . '"';
$attrib_arr[] = $key . '="' . self::quote($value) . '"';
}
}
@@ -328,22 +328,13 @@ class html
/**
* Replacing specials characters in html attribute value
*
* @param string $str Input string
* @param bool $validate Enables double quotation prevention
* @param string $str Input string
*
* @return string The quoted string
* @return string The quoted string
*/
public static function quote($str, $validate = false)
public static function quote($str)
{
$str = htmlspecialchars($str, ENT_COMPAT, RCMAIL_CHARSET);
// avoid douple quotation of &
// @TODO: get rid of it
if ($validate) {
$str = preg_replace('/&([A-Za-z]{2,6}|#[0-9]{2,4});/', '&\\1;', $str);
}
return $str;
return htmlspecialchars($str, ENT_COMPAT, RCMAIL_CHARSET);
}
}
@@ -559,7 +550,7 @@ class html_textarea extends html
}
if (!empty($value) && empty($this->attrib['is_escaped'])) {
$value = self::quote($value, true);
$value = self::quote($value);
}
return self::tag($this->tagname, $this->attrib, $value,
@@ -635,7 +626,7 @@ class html_select extends html
$option_content = $option['text'];
if (empty($this->attrib['is_escaped'])) {
$option_content = self::quote($option_content, true);
$option_content = self::quote($option_content);
}
$this->content .= self::tag('option', $attr, $option_content);