Query string sanitation in attachment_common.php

In revision 13767, some calls to htmlspecialcharacters() in
functions/attachment_common.php were removed because it was sanitizing
query strings that were already sanitized for generating "View" links
for text file attachments.  However, this bug was not fixed for the
functions that generate "View" links for image or vCard attachments.
Was there a reason for this?  I've attached a patch to correct the
behavior.

Jeff Lang

------------------------------------------------------------------------------
Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day 
trial. Simplify your report design, integration and deployment - and focus on 
what you do best, core application coding. Discover what's new with 
Crystal Reports now.  http://p.sf.net/sfu/bobj-july

-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

--- functions/attachment_common.php	2009-08-10 15:04:32.000000000 -0500
+++ functions/attachment_common.php.new	2009-08-10 15:01:14.000000000 -0500
@@ -222,7 +222,7 @@
     
     $attachment_common_show_images_list[] = $info;
 
-    $Args[0]['attachment_common']['href'] = $base_uri  . 'src/image.php?'. htmlspecialchars($QUERY_STRING);
+    $Args[0]['attachment_common']['href'] = $base_uri  . 'src/image.php?'. $QUERY_STRING;
     $Args[0]['attachment_common']['href'] =
           set_url_var($Args[0]['attachment_common']['href'],
           'ent_id',$Args[4]);
@@ -241,7 +241,7 @@
     global $base_uri;
     sqgetGlobalVar('QUERY_STRING', $QUERY_STRING, SQ_SERVER);
 
-    $Args[0]['attachment_common']['href'] = $base_uri  . 'src/vcard.php?'. htmlspecialchars($QUERY_STRING);
+    $Args[0]['attachment_common']['href'] = $base_uri  . 'src/vcard.php?'. $QUERY_STRING;
     $Args[0]['attachment_common']['href'] =
           set_url_var($Args[0]['attachment_common']['href'],
           'ent_id',$Args[4]);