Ejemplo n.º 1
0
function rcmail_mod_css_styles($source, $container_id, $allow_remote = false)
{
    return rcube_utils::mod_css_styles($source, $container_id, $allow_remote);
}
Ejemplo n.º 2
0
 /**
  * rcube_utils::mod_css_styles()
  */
 function test_mod_css_styles_xss()
 {
     $mod = rcube_utils::mod_css_styles("body.main2cols { background-image: url('../images/leftcol.png'); }", 'rcmbody');
     $this->assertEquals("/* evil! */", $mod, "No url() values allowed");
     $mod = rcube_utils::mod_css_styles("@import url('http://localhost/somestuff/css/master.css');", 'rcmbody');
     $this->assertEquals("/* evil! */", $mod, "No import statements");
     $mod = rcube_utils::mod_css_styles("left:expression(document.body.offsetWidth-20)", 'rcmbody');
     $this->assertEquals("/* evil! */", $mod, "No expression properties");
     $mod = rcube_utils::mod_css_styles("left:exp/*  */ression( alert('xss3') )", 'rcmbody');
     $this->assertEquals("/* evil! */", $mod, "Don't allow encoding quirks");
     $mod = rcube_utils::mod_css_styles("background:\\0075\\0072\\006c( javascript:alert('xss') )", 'rcmbody');
     $this->assertEquals("/* evil! */", $mod, "Don't allow encoding quirks (2)");
 }
Ejemplo n.º 3
0
function rcmail_mod_css_styles($source, $container_id, $allow_remote = false)
{
    _deprecation_warning(__FUNCTION__);
    return rcube_utils::mod_css_styles($source, $container_id, $allow_remote);
}