From 02663a41b67ca71def39df75dbdc79f0807ae5da Mon Sep 17 00:00:00 2001 From: Andrew Fyfe Date: Thu, 14 Dec 2017 16:09:10 +0000 Subject: [PATCH] escape html in plain text messages (#1326) conditional_escape is used to prevent double escaping, ImapEmail.viewmail_plain() in modoboa-webmail overrides this method and escapes content before calling Email.viewmail_plain(), SQLemail in modoboa-amavis doesn't and can potentially allow harmful html to be displayed. --- modoboa/lib/email_utils.py | 2 ++ 1 file changed, 2 insertions(+) diff --git a/modoboa/lib/email_utils.py b/modoboa/lib/email_utils.py index 4fb6c7a38..97dbb3c00 100644 --- a/modoboa/lib/email_utils.py +++ b/modoboa/lib/email_utils.py @@ -11,6 +11,7 @@ import time from django.conf import settings from django.utils.encoding import smart_text +from django.utils.html import conditional_escape from django.template.loader import render_to_string from django.utils import six @@ -199,6 +200,7 @@ class Email(object): }) def viewmail_plain(self, content, **kwargs): + content = conditional_escape(content) return "
%s
" % content def viewmail_html(self, content, **kwargs):