Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions apps/sharebymail/lib/ShareByMailProvider.php
Original file line number Diff line number Diff line change
Expand Up @@ -404,7 +404,7 @@ protected function sendMailNotification($filename,
$text = $this->l->t('%s shared »%s« with you.', [$initiatorDisplayName, $filename]);

$emailTemplate->addBodyText(
$text . ' ' . $this->l->t('Click the button below to open it.'),
htmlspecialchars($text . ' ' . $this->l->t('Click the button below to open it.')),
$text
);
$emailTemplate->addBodyButton(
Expand Down Expand Up @@ -476,7 +476,7 @@ protected function sendPassword(IShare $share, $password) {
$emailTemplate->setSubject($this->l->t('Password to access »%s« shared to you by %s', [$filename, $initiatorDisplayName]));
$emailTemplate->addHeader();
$emailTemplate->addHeading($this->l->t('Password to access »%s«', [$filename]), false);
$emailTemplate->addBodyText($htmlBodyPart, $plainBodyPart);
$emailTemplate->addBodyText(htmlspecialchars($htmlBodyPart), $plainBodyPart);
$emailTemplate->addBodyText($this->l->t('It is protected with the following password: %s', [$password]));

// The "From" contains the sharers name
Expand Down
4 changes: 2 additions & 2 deletions core/Controller/LostController.php
Original file line number Diff line number Diff line change
Expand Up @@ -321,12 +321,12 @@ protected function sendEmail($input) {
$emailTemplate->addHeading($this->l10n->t('Password reset'));

$emailTemplate->addBodyText(
$this->l10n->t('Click the following button to reset your password. If you have not requested the password reset, then ignore this email.'),
htmlspecialchars($this->l10n->t('Click the following button to reset your password. If you have not requested the password reset, then ignore this email.')),
$this->l10n->t('Click the following link to reset your password. If you have not requested the password reset, then ignore this email.')
);

$emailTemplate->addBodyButton(
$this->l10n->t('Reset your password'),
htmlspecialchars($this->l10n->t('Reset your password')),
$link,
false
);
Expand Down
28 changes: 17 additions & 11 deletions lib/private/Mail/EMailTemplate.php
Original file line number Diff line number Diff line change
Expand Up @@ -420,7 +420,7 @@ protected function ensureBodyIsOpened() {
/**
* Adds a paragraph to the body of the email
*
* @param string $text
* @param string $text Note: When $plainText falls back to this, HTML is automatically escaped in the HTML email
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please put this also in the public interface ;)

* @param string|bool $plainText Text that is used in the plain text email
* if empty the $text is used, if false none will be used
*/
Expand All @@ -430,11 +430,12 @@ public function addBodyText($text, $plainText = '') {
}
if ($plainText === '') {
$plainText = $text;
$text = htmlspecialchars($text);
}

$this->ensureBodyIsOpened();

$this->htmlBody .= vsprintf($this->bodyText, [htmlspecialchars($text)]);
$this->htmlBody .= vsprintf($this->bodyText, [$text]);
if ($plainText !== false) {
$this->plainBody .= $plainText . PHP_EOL . PHP_EOL;
}
Expand All @@ -443,8 +444,8 @@ public function addBodyText($text, $plainText = '') {
/**
* Adds a list item to the body of the email
*
* @param string $text
* @param string $metaInfo
* @param string $text Note: When $plainText falls back to this, HTML is automatically escaped in the HTML email
* @param string $metaInfo Note: When $plainMetaInfo falls back to this, HTML is automatically escaped in the HTML email
* @param string $icon Absolute path, must be 16*16 pixels
* @param string $plainText Text that is used in the plain text email
* if empty the $text is used, if false none will be used
Expand All @@ -457,14 +458,16 @@ public function addBodyListItem($text, $metaInfo = '', $icon = '', $plainText =

if ($plainText === '') {
$plainText = $text;
$text = htmlspecialchars($text);
}
if ($plainMetaInfo === '') {
$plainMetaInfo = $metaInfo;
$metaInfo = htmlspecialchars($metaInfo);
}

$htmlText = htmlspecialchars($text);
$htmlText = $text;
if ($metaInfo) {
$htmlText = '<em style="color:#777;">' . htmlspecialchars($metaInfo) . '</em><br>' . $htmlText;
$htmlText = '<em style="color:#777;">' . $metaInfo . '</em><br>' . $htmlText;
}
if ($icon !== '') {
$icon = '<img src="' . htmlspecialchars($icon) . '" alt="&bull;">';
Expand Down Expand Up @@ -503,9 +506,9 @@ protected function ensureBodyListClosed() {
/**
* Adds a button group of two buttons to the body of the email
*
* @param string $textLeft Text of left button
* @param string $textLeft Text of left button; Note: When $plainTextLeft falls back to this, HTML is automatically escaped in the HTML email
* @param string $urlLeft URL of left button
* @param string $textRight Text of right button
* @param string $textRight Text of right button; Note: When $plainTextRight falls back to this, HTML is automatically escaped in the HTML email
* @param string $urlRight URL of right button
* @param string $plainTextLeft Text of left button that is used in the plain text version - if unset the $textLeft is used
* @param string $plainTextRight Text of right button that is used in the plain text version - if unset the $textRight is used
Expand All @@ -521,10 +524,12 @@ public function addBodyButtonGroup($textLeft,
}
if ($plainTextLeft === '') {
$plainTextLeft = $textLeft;
$textLeft = htmlspecialchars($textLeft);
}

if ($plainTextRight === '') {
$plainTextRight = $textRight;
$textRight = htmlspecialchars($textRight);
}

$this->ensureBodyIsOpened();
Expand All @@ -533,7 +538,7 @@ public function addBodyButtonGroup($textLeft,
$color = $this->themingDefaults->getColorPrimary();
$textColor = $this->themingDefaults->getTextColorPrimary();

$this->htmlBody .= vsprintf($this->buttonGroup, [$color, $color, $urlLeft, $color, $textColor, $textColor, htmlspecialchars($textLeft), $urlRight, htmlspecialchars($textRight)]);
$this->htmlBody .= vsprintf($this->buttonGroup, [$color, $color, $urlLeft, $color, $textColor, $textColor, $textLeft, $urlRight, $textRight]);
$this->plainBody .= $plainTextLeft . ': ' . $urlLeft . PHP_EOL;
$this->plainBody .= $plainTextRight . ': ' . $urlRight . PHP_EOL . PHP_EOL;

Expand All @@ -542,7 +547,7 @@ public function addBodyButtonGroup($textLeft,
/**
* Adds a button to the body of the email
*
* @param string $text Text of button
* @param string $text Text of button; Note: When $plainText falls back to this, HTML is automatically escaped in the HTML email
* @param string $url URL of button
* @param string $plainText Text of button in plain text version
* if empty the $text is used, if false none will be used
Expand All @@ -559,11 +564,12 @@ public function addBodyButton($text, $url, $plainText = '') {

if ($plainText === '') {
$plainText = $text;
$text = htmlspecialchars($text);
}

$color = $this->themingDefaults->getColorPrimary();
$textColor = $this->themingDefaults->getTextColorPrimary();
$this->htmlBody .= vsprintf($this->button, [$color, $color, $url, $color, $textColor, $textColor, htmlspecialchars($text)]);
$this->htmlBody .= vsprintf($this->button, [$color, $color, $url, $color, $textColor, $textColor, $text]);

if ($plainText !== false) {
$this->plainBody .= $plainText . ': ';
Expand Down
2 changes: 1 addition & 1 deletion lib/private/Share20/Manager.php
Original file line number Diff line number Diff line change
Expand Up @@ -735,7 +735,7 @@ protected function sendMailNotification(IL10N $l,
$text = $l->t('%s shared »%s« with you.', [$initiatorDisplayName, $filename]);

$emailTemplate->addBodyText(
$text . ' ' . $l->t('Click the button below to open it.'),
htmlspecialchars($text . ' ' . $l->t('Click the button below to open it.')),
$text
);
$emailTemplate->addBodyButton(
Expand Down
12 changes: 6 additions & 6 deletions lib/public/Mail/IEMailTemplate.php
Original file line number Diff line number Diff line change
Expand Up @@ -85,7 +85,7 @@ public function addHeading($title, $plainTitle = '');
/**
* Adds a paragraph to the body of the email
*
* @param string $text
* @param string $text; Note: When $plainText falls back to this, HTML is automatically escaped in the HTML email
* @param string|bool $plainText Text that is used in the plain text email
* if empty the $text is used, if false none will be used
*
Expand All @@ -96,8 +96,8 @@ public function addBodyText($text, $plainText = '');
/**
* Adds a list item to the body of the email
*
* @param string $text
* @param string $metaInfo
* @param string $text; Note: When $plainText falls back to this, HTML is automatically escaped in the HTML email
* @param string $metaInfo; Note: When $plainMetaInfo falls back to this, HTML is automatically escaped in the HTML email
* @param string $icon Absolute path, must be 16*16 pixels
* @param string $plainText Text that is used in the plain text email
* if empty the $text is used, if false none will be used
Expand All @@ -110,9 +110,9 @@ public function addBodyListItem($text, $metaInfo = '', $icon = '', $plainText =
/**
* Adds a button group of two buttons to the body of the email
*
* @param string $textLeft Text of left button
* @param string $textLeft Text of left button; Note: When $plainTextLeft falls back to this, HTML is automatically escaped in the HTML email
* @param string $urlLeft URL of left button
* @param string $textRight Text of right button
* @param string $textRight Text of right button; Note: When $plainTextRight falls back to this, HTML is automatically escaped in the HTML email
* @param string $urlRight URL of right button
* @param string $plainTextLeft Text of left button that is used in the plain text version - if empty the $textLeft is used
* @param string $plainTextRight Text of right button that is used in the plain text version - if empty the $textRight is used
Expand All @@ -124,7 +124,7 @@ public function addBodyButtonGroup($textLeft, $urlLeft, $textRight, $urlRight, $
/**
* Adds a button to the body of the email
*
* @param string $text Text of button
* @param string $text Text of button; Note: When $plainText falls back to this, HTML is automatically escaped in the HTML email
* @param string $url URL of button
* @param string $plainText Text of button in plain text version
* if empty the $text is used, if false none will be used
Expand Down