add 'sandbox' attr to Horde_Mime_Part iframes #19
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
the "allow-same-origin" value is needed. Otherwise the email can not be displayed
ralflang
approved these changes
Jun 4, 2025
Member
|
@TDannhauer I'd like to move forward with this PR. Besides the conflict it looks good. Opinion? |
ralflang
approved these changes
Jun 4, 2025
Member
ralflang
left a comment
ralflang
left a comment
There was a problem hiding this comment.
Re approve after solving merge conflict
Contributor
|
looks good for me. Let's move on! |
ralflang
added a commit
that referenced
this pull request
Jun 4, 2025
the "allow-same-origin" value is needed. Otherwise the email can not be displayed Co-authored-by: Ralf Lang <ralf.lang@ralf-lang.de> Co-authored-by: Pasche, B1 Systems <pasche@b1-systems.de>
ralflang
added a commit
that referenced
this pull request
Jun 4, 2025
fix: Add conditional to hook class template to prevent double declaration issues fix: add 'sandbox' attr to Horde_Mime_Part iframes (#19) fix: Move assignment up fix: Shield against null returned from getCharset fix: Shield against null returned from getContentTypeParameter
|
With this change, users are no longer able to click on most links in their mail messages ("such as the "View on GitHub" link on the bottom of GitHub PR emails) and have it open in a new tab. My users are definitely complaining about it. I changed it to sandbox="allow-scripts allow-same-origin allow-popups", but I'm not sure if that defeats the purpose of the security change or not. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
the "allow-same-origin" value is needed. Otherwise the email can not be displayed
This is meant as an additional countermeasure against XSS attacks in html emails. I am not 100% sure this won't break some html emails. In my tests it did not lead to any issues.