File roundcubemail-1.0.9-001-acf633c-boo_982003.patch of Package roundcubemail.4690

From acf633c73bc8df9a5036bc52d7568f4213ab73c7 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Fri, 6 May 2016 08:28:15 +0200
Subject: [PATCH] Fix XSS issue in href attribute on area tag (#5240, #5241)

Conflicts:

	CHANGELOG
---
 CHANGELOG                               |  2 ++
 program/lib/Roundcube/rcube_washtml.php |  2 +-
 tests/Framework/Washtml.php             | 17 +++++++++++++++++
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG b/CHANGELOG
index 054de01..1f755a0 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,8 @@
 CHANGELOG Roundcube Webmail
 ===========================
 
+- Fix XSS issue in href attribute on area tag (#5240)
+
 RELEASE 1.0.9
 -------------
 - Fix a regression where some contact data was missing in export and PHP warnings were logged (Kolab #4522)
diff --git a/program/lib/Roundcube/rcube_washtml.php b/program/lib/Roundcube/rcube_washtml.php
index 2b31033..f5a48e8 100644
--- a/program/lib/Roundcube/rcube_washtml.php
+++ b/program/lib/Roundcube/rcube_washtml.php
@@ -366,7 +366,7 @@ private function wash_uri($uri, $blocked_source = false)
      */
     private function is_link_attribute($tag, $attr)
     {
-        return $tag == 'a' && $attr == 'href';
+        return ($tag == 'a' || $tag == 'area') && $attr == 'href';
     }
 
     /**