From 9b65ca00dfc771b68de0f5d50d5360150a3a1abe Mon Sep 17 00:00:00 2001
From: thomasb <thomasb@208e9e7b-5314-0410-a742-e7e81cd9613c>
Date: Wed, 19 Jul 2006 19:36:35 +0000
Subject: Improved usability (Ticket #1483807) and HTML validity; applied patch
 #1328032; fixed bug #1443200

git-svn-id: https://svn.roundcube.net/trunk@277 208e9e7b-5314-0410-a742-e7e81cd9613c
---
 roundcubemail/program/steps/mail/show.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'roundcubemail/program/steps')

diff --git a/roundcubemail/program/steps/mail/show.inc b/roundcubemail/program/steps/mail/show.inc
index 27fc44b3f..26a3d3312 100644
--- a/roundcubemail/program/steps/mail/show.inc
+++ b/roundcubemail/program/steps/mail/show.inc
@@ -109,8 +109,8 @@ function rcmail_message_attachments($attrib)
                         $attach_prop['filename'],
                         show_bytes($attach_prop['size']));
       else
-        $out .= sprintf('<li><a href="%s&_part=%s" onclick="return %s.command(\'load-attachment\',{part:\'%s\', mimetype:\'%s\'},this)">%s</a></li>'."\n",
-                        $GET_URL,
+        $out .= sprintf('<li><a href="%s&amp;_part=%s" onclick="return %s.command(\'load-attachment\',{part:\'%s\', mimetype:\'%s\'},this)">%s</a></li>'."\n",
+                        htmlentities($GET_URL),
                         $attach_prop['part_id'],
                         $JS_OBJECT_NAME,
                         $attach_prop['part_id'],
-- 
cgit v1.2.3