From c1727b389e9cc933fcfa1609168f46011cc6901c Mon Sep 17 00:00:00 2001
From: OpenXE <>
Date: Mon, 15 Apr 2024 18:28:11 +0200
Subject: [PATCH] ticket system added content security policy, resizeable view
 for ticket nachricht

---
 www/pages/content/ticket_nachricht.tpl |  6 +--
 www/pages/ticket.php                   | 63 +++++++++++++-------------
 www/themes/new/css/styles.css          |  6 ++-
 www/themes/new/css/ticket_iframe.css   | 20 ++++++++
 4 files changed, 59 insertions(+), 36 deletions(-)
 create mode 100644 www/themes/new/css/ticket_iframe.css

diff --git a/www/pages/content/ticket_nachricht.tpl b/www/pages/content/ticket_nachricht.tpl
index 8452ac29..75cdf788 100644
--- a/www/pages/content/ticket_nachricht.tpl
+++ b/www/pages/content/ticket_nachricht.tpl
@@ -18,12 +18,10 @@
                                             </fieldset> 
                                         </div>
                                		</div>                         		         
-                                    <div class="col-xs-12 col-md-8 col-md-height ticket_nachricht_box" style="float:[NACHRICHT_FLOAT]">
+                                    <div class="col-xs-12 col-md-8 col-md-height" style="float:[NACHRICHT_FLOAT]">
 	                        			<div class="inside inside-full-height">
 	                        				<fieldset>
-                                                <table width="100%" border="0" class="mkTableFormular">
-                                                    <tr><td colspan=2><div id="body" class="ticket_text_div">[NACHRICHT_TEXT]</div></td></tr>
-                                                </table>
+                                                <div id="body" class="ticket_nachricht_box">[NACHRICHT_TEXT]</div>
                                             </fieldset> 
                                         </div>
                                		</div>                         
diff --git a/www/pages/ticket.php b/www/pages/ticket.php
index eead0b40..c004245b 100644
--- a/www/pages/ticket.php
+++ b/www/pages/ticket.php
@@ -481,7 +481,8 @@ class Ticket {
             '<ul>',
             '<li>',
             '<dd>',
-            '<dt>'
+            '<dt>',
+            '<img>'
         );
 
         $mid = $this->app->Secure->GetGET('mid');
@@ -496,37 +497,37 @@ class Ticket {
         if (empty($messages)) {
         }
 
-        if ($insecure) {
-            // Adjust cid images
-            $attachments = $this->app->erp->GetDateiSubjektObjekt('Anhang','Ticket',$mid);
-            foreach($attachments as $attachment) {
-                $filename = $this->app->erp->GetDateiName($attachment);
-                $messages[0]['text'] = str_replace($filename,'index.php?module=dateien&action=send&id='.$attachment,$messages[0]['text']);
-            }
-            $this->app->Tpl->Set("TEXT",$messages[0]['text']);
-        } else {
-
-            $secure_text = strip_tags($messages[0]['text'],$secure_html_tags);
-
-            if (strlen($secure_text) != strlen($messages[0]['text'])) {
-            
-                $blink_style_tag = "
-                <style>
-                @keyframes animation_blink {
-                    0% { opacity: 1; }
-                    25% { opacity: 1; }
-                    26% { opacity: 0; }
-                    75% { opacity: 0; }
-                    76% { opacity: 1; }
-                    100% { opacity: 1; }        
-                }
-                </style>                
-                ";                
-                $blink_css = "animation-name:animation_blink;animation-timing-function:linear;animation-duration:2s;animation-iteration-count:5;";                                                  
-                $secure_text = $blink_style_tag."<img src=\"./themes/{$this->app->Conf->WFconf['defaulttheme']}/images/icon-invisible.svg\" alt=\"Einige Elemente wurden durch OpenXE blockiert.\" title=\"Einige Elemente wurden durch OpenXE blockiert.\" border=\"0\" style=\"all: initial;display:block;float:right;font-size:small;".$blink_css."\">".$secure_text;
-            }
-            $this->app->Tpl->Set("TEXT",$secure_text);
+        $html_start = "<!DOCTYPE html><html>";
+        $head_start = "<head>";
+        $security = "";
+        $style = "<link rel=\"stylesheet\" type=\"text/css\" href=\"./themes/new/css/ticket_iframe.css?v=3\"/>";
+        $head_end = "</head>";
+        $html_end = "</html>";
+        $prepared_text = $messages[0]['text'];
+               
+        // Adjust cid images
+        $attachments = $this->app->erp->GetDateiSubjektObjekt('Anhang','Ticket',$mid);
+        foreach($attachments as $attachment) {
+            $filename = $this->app->erp->GetDateiName($attachment);
+            $prepared_text = str_replace($filename,'index.php?module=dateien&action=send&id='.$attachment,$prepared_text);
         }
+        
+        if ($insecure) {            
+            // Add Content Security Policy
+        } else {
+       
+            // Add Content Security Policy
+            $security = "<meta  http-equiv=\"Content-Security-Policy\" content=\"default-src 'self';\" />";
+       
+            // Strip html tags
+            $stripped_prepared_text = strip_tags($prepared_text,$secure_html_tags);           
+           
+            if (strlen($stripped_prepared_text) != strlen($prepared_text)) {                                           
+                $stripped_prepared_text = "<img class=\"eye blink\" src=\"./themes/{$this->app->Conf->WFconf['defaulttheme']}/images/icon-invisible.svg\" alt=\"Einige Elemente wurden durch OpenXE blockiert.\" title=\"Einige Elemente wurden durch OpenXE blockiert.\" border=\"0\">".$stripped_prepared_text;
+            }        
+            $prepared_text = $stripped_prepared_text;        
+        }        
+        $this->app->Tpl->Set("TEXT",$html_start.$head_start.$security.$style.$head_end.$prepared_text.$html_end);        
         $this->app->Tpl->Output('ticket_text.tpl');
         $this->app->ExitXentral();
     }
diff --git a/www/themes/new/css/styles.css b/www/themes/new/css/styles.css
index f4d39782..c8964ca4 100644
--- a/www/themes/new/css/styles.css
+++ b/www/themes/new/css/styles.css
@@ -2404,6 +2404,10 @@ ul.tag-editor {
     border-color: var(--textfield-border);
     border-radius: 7px;
     padding: 0px !important;
+    min-height: 300px;
+    height: 300px;
+    resize: vertical;
+    overflow: hidden;
 }
 
 .ticket_nachricht_box fieldset {
@@ -2412,8 +2416,8 @@ ul.tag-editor {
 
 .ticket_text {
     width: 100%;
+    height: 100%;
     border: none;
-    height: 300px;
 }
 
 .ui-button-icon,
diff --git a/www/themes/new/css/ticket_iframe.css b/www/themes/new/css/ticket_iframe.css
new file mode 100644
index 00000000..60508127
--- /dev/null
+++ b/www/themes/new/css/ticket_iframe.css
@@ -0,0 +1,20 @@
+@keyframes animation_blink {
+    0% { opacity: 1; }
+    25% { opacity: 1; }
+    26% { opacity: 0; }
+    75% { opacity: 0; }
+    76% { opacity: 1; }
+    100% { opacity: 1; }        
+}                
+.eye {
+    all: initial;
+    display:block;
+    float:right;
+    font-size:small;
+}             
+.blink {
+    animation-name:animation_blink;
+    animation-timing-function:linear;
+    animation-duration:2s;
+    animation-iteration-count:5;
+}