Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(Notification): fix conversion of relative URLs to aboslue URLs #16350

Merged

Conversation

stonebuzz
Copy link
Contributor

@stonebuzz stonebuzz commented Jan 11, 2024

Since the replacement of htmlawed

the symfony component used to make HTML safe encodes = with =

<a href="/front/document.send.php?docid&#61;9122&amp;itemtype&#61;Ticket&amp;items_id&#61;38142" target="_blank" rel="noopener"><img src="/front/document.send.php?docid&#61;9122&amp;itemtype&#61;Ticket&amp;items_id&#61;38142" alt="d40c9e53-f37490bd-63ec57f1a8efc3.58665698" width="4032" /></a>

GLPI's notification system tries to convert relative URLs into absolute URLs via a reg_replace

foreach ($inline_docs as $docID => $filename) {
    $current->fields['body_html'] = preg_replace(
        [
            '/src=["\'][^"\']*document\.send\.php\?docid=' . $docID . '(&[^"\']+)?["\']/',
            '/href=["\'][^"\']*document\.send\.php\?docid=' . $docID . '(&[^"\']+)?["\']/',
        ],
        [
            // 'cid' must be identical as second arg used in `embedFromPath` method
            // Symfony/Mime will then replace it by an auto-generated value
            // see Symfony\Mime\Email::prepareParts()
            'src="cid:' . $filename . '"',
            'href="' . $CFG_GLPI['url_base'] . '/front/document.send.php?docid=' . $docID . '$1"',
        ],
        $current->fields['body_html']
    );
}

Method no longer works due to the HTML encoding of =

I'm not an expert in HTML encoding/decoding, so this commit is a first test to see how the unit tests behave.

Perhaps another solution would be to adapt the REGEXs to match &#61;

Q A
Bug fix? yes/no
New feature? yes/no
BC breaks? no
Deprecations? no
Tests pass? yes
Fixed tickets !28203

@stonebuzz stonebuzz marked this pull request as draft January 11, 2024 09:52
@stonebuzz stonebuzz requested a review from cedric-anne January 11, 2024 09:54
@stonebuzz stonebuzz self-assigned this Jan 11, 2024
@stonebuzz stonebuzz added the bug label Jan 11, 2024
@stonebuzz stonebuzz added this to the 10.1.0 milestone Jan 11, 2024
Copy link
Member

@cedric-anne cedric-anne left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the only solution to fix it quickly will be to adapt all regex to use (?:=|&#61;) instead of =. Usage of ?: to prevent capture would help to prevent any impact on results indexes.

@stonebuzz stonebuzz requested a review from cedric-anne January 11, 2024 14:20
Copy link
Member

@cedric-anne cedric-anne left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It seems OK, but I would like to make some tests before giving a validation.

@stonebuzz stonebuzz marked this pull request as ready for review January 15, 2025 11:06
@trasher trasher requested a review from cedric-anne January 16, 2025 07:41
@cedric-anne cedric-anne force-pushed the fix_relative_url_conversion branch from 7e0d1ea to a96133c Compare January 16, 2025 07:47
@cedric-anne cedric-anne force-pushed the fix_relative_url_conversion branch from a96133c to 92b6b2e Compare January 16, 2025 08:38
@cedric-anne cedric-anne merged commit f75d72c into glpi-project:main Jan 16, 2025
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants