From f03ce0f9e2b48516566c42046834250358c27d3f Mon Sep 17 00:00:00 2001
From: netbit <netbit@208e9e7b-5314-0410-a742-e7e81cd9613c>
Date: Wed, 9 Jun 2010 19:08:15 +0000
Subject:  - Sanitize CSS universal selector from e-mails. Without this fix any
 message can play with the CSS from entire mail window or mail preview frame.
 Test case: <style type="text/css">*{ background: #000; }</style>

git-svn-id: https://svn.roundcube.net/trunk@3740 208e9e7b-5314-0410-a742-e7e81cd9613c
---
 roundcubemail/program/include/main.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'roundcubemail/program/include')

diff --git a/roundcubemail/program/include/main.inc b/roundcubemail/program/include/main.inc
index f98e4311e..e5fe3929b 100644
--- a/roundcubemail/program/include/main.inc
+++ b/roundcubemail/program/include/main.inc
@@ -1,4 +1,4 @@
-<?php
+<?php
 
 /*
  +-----------------------------------------------------------------------+
@@ -843,7 +843,7 @@ function rcmail_mod_css_styles($source, $container_id)
   $styles = preg_replace(
     array(
       '/(^\s*<!--)|(-->\s*$)/',
-      '/(^\s*|,\s*|\}\s*)([a-z0-9\._#][a-z0-9\.\-_]*)/im',
+      '/(^\s*|,\s*|\}\s*)([a-z0-9\._#\*][a-z0-9\.\-_]*)/im',
       "/$container_id\s+body/i",
     ),
     array(
-- 
cgit v1.2.3