Fix regression where printing/scaling/rotating image attachments was …

…broken (roundcube#9571)
respiranto · Aug 8, 2024 · cd0bde2 · cd0bde2
1 parent bb58679
commit cd0bde2
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 11 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -57,6 +57,7 @@
 - Fix attachment name decoding when 'charset' parameter exists in the headers (#9376)
 - Fix deprecated (in PHP 8.4) use of session_set_save_handler() (#9060)
 - Fix potential HTTP protocol version mismatch (#8982)
+- Fix regression where printing/scaling/rotating image attachments was broken (#9571)
 
 ## Release 1.6.8
 

diff --git a/program/js/app.js b/program/js/app.js
@@ -456,12 +456,9 @@ function rcube_webmail() {
 
                             // do not apply styles to an error page (with no image)
                             if (contents.find('img').length) {
-                                contents.find('head').append(
-                                    '<style type="text/css">'
-                                        + 'img { max-width:100%; max-height:100%; } ' // scale
-                                        + 'body { display:flex; align-items:center; justify-content:center; height:100%; margin:0; }' // align
-                                        + '</style>'
-                                );
+                                contents.find('img').css({ maxWidth: '100%', maxHeight: '100%' });
+                                contents.find('body').css({ display: 'flex', alignItems: 'center', justifyContent: 'center', height: '100%', margin: 0 });
+                                contents.find('html').css({ height: '100%' });
                             }
                         });
                     }
@@ -6009,9 +6006,7 @@ function rcube_webmail() {
 
     this.apply_image_style = function () {
         var style = [],
-            head = $(this.gui_objects.messagepartframe).contents().find('head');
-
-        $('#image-style', head).remove();
+            img = $(this.gui_objects.messagepartframe).contents().find('img');
 
         $.each({ scale: '', rotate: 'deg' }, function (i, v) {
             var val = ref.image_style[i];
@@ -6021,7 +6016,7 @@ function rcube_webmail() {
         });
 
         if (style) {
-            head.append($('<style id="image-style">').text('img { transform: ' + style.join(' ') + '}'));
+            img.css('transform', style.join(' '));
         }
     };
 

diff --git a/program/lib/Roundcube/rcube_output.php b/program/lib/Roundcube/rcube_output.php
@@ -281,7 +281,8 @@ public function download_headers($filename, $params = [])
         }
 
         // Use strict security policy to make sure no javascript content is executed
-        $this->header("Content-Security-Policy: default-src 'none'");
+        // img-src is needed to be able to print attachment preview page
+        $this->header("Content-Security-Policy: default-src 'none'; img-src 'self'");
 
         // don't kill the connection if download takes more than 30 sec.
         if (!array_key_exists('time_limit', $params)) {