Another place to use JSON encoding instead of addslashes()

diff --git a/imp/js/compose-dimp.js b/imp/js/compose-dimp.js
index 5b9c396..d9296a1 100644 (file)
--- a/imp/js/compose-dimp.js
+++ b/imp/js/compose-dimp.js
@@ -287,7 +287,12 @@ var DimpCompose = {
             case 'addAttachment':
                 this.uploading = false;
                 if (d.success) {
-                    this.addAttach(d.atc.num, d.atc.name, d.atc.type, d.atc.size);
+                    this.addAttach({
+                        name: d.atc.name,
+                        num: d.atc.num,
+                        size: d.atc.size,
+                        type: d.atc.type
+                    });
                 }
 
                 $('upload_wait').hide();
@@ -563,7 +568,12 @@ var DimpCompose = {
     {
         if (f && f.size()) {
             f.each(function(ptr) {
-                this.addAttach(ptr.num, ptr.name, ptr.type, ptr.size);
+                this.addAttach({
+                    name: ptr.name,
+                    num: ptr.num,
+                    size: ptr.size,
+                    type: ptr.type
+                });
             }, this);
         }
     },
@@ -600,15 +610,20 @@ var DimpCompose = {
         }
     },
 
-    addAttach: function(atc_num, name, type, size)
+    // opts = (Object)
+    //   'name' - (string) Attachment name
+    //   'num' - (integer) Attachment number
+    //   'size' - (integer) Size, in KB
+    //   'type' - (string) MIME type
+    addAttach: function(opts)
     {
-        var span = new Element('SPAN').insert(name),
-            li = new Element('LI').insert(span).insert(' [' + type + '] (' + size + ' KB) '),
-            input = new Element('SPAN', { atc_id: atc_num, className: 'remove' }).insert(DIMP.text_compose.remove);
+        var span = new Element('SPAN').insert(opts.name),
+            li = new Element('LI').insert(span).insert(' [' + opts.type + '] (' + opts.size + ' KB) '),
+            input = new Element('SPAN', { atc_id: opts.num, className: 'remove' }).insert(DIMP.text_compose.remove);
         li.insert(input);
         $('attach_list').insert(li).show();
 
-        if (type != 'application/octet-stream') {
+        if (opts.type != 'application/octet-stream') {
             span.addClassName('attachName');
         }
 

diff --git a/imp/lib/Views/Compose.php b/imp/lib/Views/Compose.php
index 56d20fa..6b174fa 100644 (file)
--- a/imp/lib/Views/Compose.php
+++ b/imp/lib/Views/Compose.php
@@ -61,7 +61,13 @@ class IMP_Views_Compose
                 $imp_compose->numberOfAttachments()) {
                 foreach ($imp_compose->getAttachments() as $num => $atc) {
                     $mime = $atc['part'];
-                    $result['jsonload'][] = 'DimpCompose.addAttach(' . $num . ', \'' . addslashes($mime->getName(true)) . '\', \'' . addslashes($mime->getType()) . '\', \'' . addslashes($mime->getSize()) . "')";
+                    $opts = Horde_Serialize::serialize(array(
+                        'name' => $mime->getName(true),
+                        'num' => intval($num),
+                        'size' => $mime->getSize(),
+                        'type' => $mime->getType()
+                    ), Horde_Serialize::JSON, $GLOBALS['registry']->getCharset());
+                    $result['jsonload'][] = 'DimpCompose.addAttach(' . $opts . ')';
                 }
             }