Merge branch 'fix'

application/Espo/Core/Utils/ClientManager.php

@@ -118,6 +118,10 @@ class ClientManager
             $string .= ' ' . $src;
         }
 
+        if (!$this->config->get('clientCspFormActionDisabled')) {
+            $string .= "; form-action 'self'";
+        }
+
         // Checking the parameter for bc.
         if (!$this->config->get('clientXFrameOptionsHeaderDisabled')) {
             $string .= '; frame-ancestors';

client/src/view-helper.js

@@ -77,6 +77,22 @@ class ViewHelper {
             if (node instanceof HTMLOListElement && node.start && node.start > 99) {
                 node.removeAttribute('start');
             }
+
+            if (node instanceof HTMLFormElement) {
+                if (node.action) {
+                    node.removeAttribute('action');
+                }
+
+                if (node.hasAttribute('method')) {
+                    node.removeAttribute('method');
+                }
+            }
+
+            if (node instanceof HTMLButtonElement) {
+                if (node.type === 'submit') {
+                    node.type = 'button';
+                }
+            }
         });
 
         DOMPurify.addHook('afterSanitizeAttributes', function (node) {
@@ -93,6 +109,29 @@ class ViewHelper {
                 }
             }
         });
+
+        DOMPurify.addHook('uponSanitizeAttribute', (node, data) => {
+            if (data.attrName === 'style') {
+                const style = data.attrValue
+                    .split(';')
+                    .map(s => s.trim())
+                    .filter(rule => {
+                        const [property, value] = rule.split(':')
+                            .map(s => s.trim().toLowerCase());
+
+                        if (
+                            property === 'position' &&
+                            ['absolute', 'fixed', 'sticky'].includes(value)
+                        ) {
+                            return false;
+                        }
+
+                        return true;
+                    });
+
+                data.attrValue = style.join('; ');
+            }
+        });
     }
 
     /**

client/src/views/email/modals/body-plain.js

@@ -32,7 +32,14 @@ export default class extends ModalView {
 
     backdrop = true
 
-    templateContent = `<div class="field" data-name="body-plain">{{{bodyPlain}}}</div>`
+    templateContent = `
+        <div class="panel no-side-margin">
+            <div class="panel-body">
+                <div class="field" data-name="body-plain">{{{bodyPlain}}}</div>
+            </div>
+
+        </div>
+    `
 
     setup() {
         super.setup();
@@ -52,6 +59,7 @@ export default class extends ModalView {
                 params: {
                     readOnly: true,
                     inlineEditDisabled: true,
+                    displayRawText: true,
                 },
             },
         });