[incubator-ponymail] branch master updated: Escape quotes instead of cropping them.

[hu...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

humbedooh pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/incubator-ponymail.git


The following commit(s) were added to refs/heads/master by this push:
     new 708f9b8  Escape quotes instead of cropping them.
708f9b8 is described below

commit 708f9b8a6053349c2885ce2922c43ca8400b8c9a
Author: Daniel Gruno <hu...@apache.org>
AuthorDate: Mon Jan 20 20:06:59 2020 +0100

    Escape quotes instead of cropping them.
---
 site/api/email.lua | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/site/api/email.lua b/site/api/email.lua
index 292df00..c268d58 100644
--- a/site/api/email.lua
+++ b/site/api/email.lua
@@ -30,7 +30,7 @@ function handle(r)
     cross.contentType(r, "application/json; charset=UTF-8")
     local get = r:parseargs()
     -- get the parameter (if any) and tidy it up
-    local eid = (get.id or ""):gsub("\"", "")
+    local eid = (get.id or ""):gsub('"', '%%22')
     -- If it is the empty string then set it to "1" so ES doesn't barf
     -- N.B. ?id is treated as ?id=1
     if #eid == 0 then eid = "1" end
@@ -59,7 +59,9 @@ function handle(r)
         
         -- If we can access this email, ...
         if aaa.canAccessDoc(r, doc, account) then
-            doc.tid = doc.request_id
+            -- Because we allow quotes in message-IDs, we need to escape for standard UI.
+            doc.tid = r:escape_html(doc.request_id)
+            doc.mid = r:escape_html(doc.mid)
             
             -- Are we in fact looking for an attachment inside this email?
             if get.attachment then