From 8451bed2e87a42df00f5f4937cb8ff1d0017c8aa Mon Sep 17 00:00:00 2001
From: Leo <neleo@gmx.net>
Date: Mon, 18 Jun 2018 08:58:31 +0200
Subject: [PATCH] display archiving and retention rules correctly if they
 contain HTML entities (e.g. angle brackets in the mail address)

---
 .../theme/default/templates/policy/archiving.tpl     | 12 ++++++------
 .../theme/default/templates/policy/retention.tpl     | 12 ++++++------
 .../view/theme/mobile/templates/policy/archiving.tpl | 12 ++++++------
 .../view/theme/mobile/templates/policy/retention.tpl | 12 ++++++------
 4 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/webui/view/theme/default/templates/policy/archiving.tpl b/webui/view/theme/default/templates/policy/archiving.tpl
index 382e93c6..e20c6b35 100644
--- a/webui/view/theme/default/templates/policy/archiving.tpl
+++ b/webui/view/theme/default/templates/policy/archiving.tpl
@@ -106,14 +106,14 @@
 
 <?php foreach($rules as $rule) { ?>
       <tr class="domainrow">
-         <td><?php print $rule['from']; ?></td>
-         <td><?php print $rule['to']; ?></td>
-         <td><?php print $rule['subject']; ?></td>
-         <td><?php print $rule['body']; ?></td>
+         <td><?php print htmlentities($rule['from']); ?></td>
+         <td><?php print htmlentities($rule['to']); ?></td>
+         <td><?php print htmlentities($rule['subject']); ?></td>
+         <td><?php print htmlentities($rule['body']); ?></td>
          <td><?php if($rule['spam'] == -1) { print "-"; } else if($rule['spam'] == 0) { print $text_not_spam; } else { print $text_spam; } ?></td>
          <td><?php if($rule['size'] > 0) { print $rule['_size']; ?> <?php print $rule['size']; } ?></td>
-         <td><?php print $rule['attachment_name']; ?></td>
-         <td><?php print $rule['attachment_type']; ?></td>
+         <td><?php print htmlentities($rule['attachment_name']); ?></td>
+         <td><?php print htmlentities($rule['attachment_type']); ?></td>
          <td><?php if($rule['attachment_size'] > 0) { print $rule['_attachment_size']; ?> <?php print $rule['attachment_size']; } ?></td>
          <td><a href="index.php?route=policy/removearchiving&amp;id=<?php print $rule['id']; ?>"><?php print $text_remove; ?></a></td>
       </tr>
diff --git a/webui/view/theme/default/templates/policy/retention.tpl b/webui/view/theme/default/templates/policy/retention.tpl
index 5c3c8355..d575e245 100644
--- a/webui/view/theme/default/templates/policy/retention.tpl
+++ b/webui/view/theme/default/templates/policy/retention.tpl
@@ -128,14 +128,14 @@
 <?php if(ENABLE_SAAS == 1) { ?>
          <td><?php print $rule['domain']; ?></td>
 <?php } ?>
-         <td><?php print $rule['from']; ?></td>
-         <td><?php print $rule['to']; ?></td>
-         <td><?php print $rule['subject']; ?></td>
-         <td><?php print $rule['body']; ?></td>
+         <td><?php print htmlentities($rule['from']); ?></td>
+         <td><?php print htmlentities($rule['to']); ?></td>
+         <td><?php print htmlentities($rule['subject']); ?></td>
+         <td><?php print htmlentities($rule['body']); ?></td>
          <td><?php if($rule['spam'] == -1) { print "-"; } else if($rule['spam'] == 0) { print $text_not_spam; } else { print $text_spam; } ?></td>
          <td><?php if($rule['size'] > 0) { print $rule['_size']; ?> <?php print $rule['size']; } ?></td>
-         <td><?php print $rule['attachment_name']; ?></td>
-         <td><?php print $rule['attachment_type']; ?></td>
+         <td><?php print htmlentities($rule['attachment_name']); ?></td>
+         <td><?php print htmlentities($rule['attachment_type']); ?></td>
          <td><?php if($rule['attachment_size'] > 0) { print $rule['_attachment_size']; ?> <?php print $rule['attachment_size']; } ?></td>
          <td><?php print $rule['days']; ?></td>
          <td><a href="index.php?route=policy/removeretention&amp;id=<?php print $rule['id']; ?>"><?php print $text_remove; ?></a></td>
diff --git a/webui/view/theme/mobile/templates/policy/archiving.tpl b/webui/view/theme/mobile/templates/policy/archiving.tpl
index d8e68786..fb76d1bd 100644
--- a/webui/view/theme/mobile/templates/policy/archiving.tpl
+++ b/webui/view/theme/mobile/templates/policy/archiving.tpl
@@ -102,14 +102,14 @@
 
 <?php foreach($rules as $rule) { ?>
       <div class="domainrow">
-         <div class="domaincell"><?php print $rule['from']; ?></div>
-         <div class="domaincell"><?php print $rule['to']; ?></div>
-         <div class="domaincell"><?php print $rule['subject']; ?></div>
-         <div class="domaincell"><?php print $rule['body']; ?></div>
+         <div class="domaincell"><?php print htmlentities($rule['from']); ?></div>
+         <div class="domaincell"><?php print htmlentities($rule['to']); ?></div>
+         <div class="domaincell"><?php print htmlentities($rule['subject']); ?></div>
+         <div class="domaincell"><?php print htmlentities($rule['body']); ?></div>
          <div class="domaincell"><?php if($rule['spam'] == -1) { print "-"; } else if($rule['spam'] == 0) { print $text_not_spam; } else { print $text_spam; } ?></div>
          <div class="domaincell"><?php if($rule['size'] > 0) { print $rule['_size']; ?> <?php print $rule['size']; } ?></div>
-         <div class="domaincell"><?php print $rule['attachment_name']; ?></div>
-         <div class="domaincell"><?php print $rule['attachment_type']; ?></div>
+         <div class="domaincell"><?php print htmlentities($rule['attachment_name']); ?></div>
+         <div class="domaincell"><?php print htmlentities($rule['attachment_type']); ?></div>
          <div class="domaincell"><?php if($rule['attachment_size'] > 0) { print $rule['_attachment_size']; ?> <?php print $rule['attachment_size']; } ?></div>
          <div class="domaincell"><a href="index.php?route=policy/removearchiving&amp;confirmed=1&amp;id=<?php print $rule['id']; ?>" onclick="if(confirm('<?php print $text_remove_rule; ?>: ' + '#<?php print $rule['id']; ?>')) return true; return false;"><?php print $text_remove; ?></a></div>
       </div>
diff --git a/webui/view/theme/mobile/templates/policy/retention.tpl b/webui/view/theme/mobile/templates/policy/retention.tpl
index 26c08fd6..d02219bc 100644
--- a/webui/view/theme/mobile/templates/policy/retention.tpl
+++ b/webui/view/theme/mobile/templates/policy/retention.tpl
@@ -122,14 +122,14 @@
 <?php if(ENABLE_SAAS == 1) { ?>
          <div class="domaincell"><?php print $rule['domain']; ?></div>
 <?php } ?>
-         <div class="domaincell"><?php print $rule['from']; ?></div>
-         <div class="domaincell"><?php print $rule['to']; ?></div>
-         <div class="domaincell"><?php print $rule['subject']; ?></div>
-         <div class="domaincell"><?php print $rule['body']; ?></div>
+         <div class="domaincell"><?php print htmlentities($rule['from']); ?></div>
+         <div class="domaincell"><?php print htmlentities($rule['to']); ?></div>
+         <div class="domaincell"><?php print htmlentities($rule['subject']); ?></div>
+         <div class="domaincell"><?php print htmlentities($rule['body']); ?></div>
          <div class="domaincell"><?php if($rule['spam'] == -1) { print "-"; } else if($rule['spam'] == 0) { print $text_not_spam; } else { print $text_spam; } ?></div>
          <div class="domaincell"><?php if($rule['size'] > 0) { print $rule['_size']; ?> <?php print $rule['size']; } ?></div>
-         <div class="domaincell"><?php print $rule['attachment_name']; ?></div>
-         <div class="domaincell"><?php print $rule['attachment_type']; ?></div>
+         <div class="domaincell"><?php print htmlentities($rule['attachment_name']); ?></div>
+         <div class="domaincell"><?php print htmlentities($rule['attachment_type']); ?></div>
          <div class="domaincell"><?php if($rule['attachment_size'] > 0) { print $rule['_attachment_size']; ?> <?php print $rule['attachment_size']; } ?></div>
          <div class="domaincell"><?php print $rule['days']; ?></div>
          <div class="domaincell"><a href="index.php?route=policy/removeretention&amp;confirmed=1&amp;id=<?php print $rule['id']; ?>" onclick="if(confirm('<?php print $text_remove_rule; ?>: ' + '#<?php print $rule['id']; ?>')) return true; return false;"><?php print $text_remove; ?></a></div>