Index: mimemail.inc
===================================================================
RCS file: /cvs/drupal-contrib/contributions/modules/mimemail/mimemail.inc,v
retrieving revision 1.29
diff -u -p -r1.29 mimemail.inc
--- mimemail.inc	8 Aug 2008 04:24:18 -0000	1.29
+++ mimemail.inc	10 Aug 2008 20:49:48 -0000
@@ -86,8 +86,8 @@ function mimemail_headers($headers, $fro
  *                  )
  */
 function mimemail_extract_files($html) {
-  $pattern = '/(<link[^>]+href="?|<object[^>]+codebase="?|@import |src="?)\/?([^"]+)("?)/emis';
-  $html = preg_replace($pattern, '"\\1". _mimemail_file("\\2") ."\\3"', $html);
+  $pattern = '/(<link[^>]+href=[\'"]?|<object[^>]+codebase=[\'"]?|@import |src=[\'"]?)([^\'>"]+)([\'"]?)/emis';
+  $html = preg_replace($pattern, 'stripslashes("\\1"). _mimemail_file("\\2") .stripslashes("\\3")', $html);
 
   $document = array(array(
     'Content-Type' => "text/html; charset=utf-8",
@@ -103,14 +103,18 @@ function mimemail_extract_files($html) {
 /**
  * Helper function to extract local files
  *
- * @param $file a link to a file
+ * @param $url a URL to a file
  *
  * @return an absolute :
  */
-function _mimemail_file($file = NULL, $name = '', $type = '', $disposition = 'related') {
+function _mimemail_file($url = NULL, $name = '', $type = '', $disposition = 'related') {
   static $files = array();
 
-  if ($file && !preg_match('@://|mailto:@', $file) && file_exists($file)) {
+  if ($url) {
+    $file = _mimemail_url_to_file($url);
+  }
+
+  if ($file && file_exists($file)) {
     $content_id = md5($file) .'@'. $_SERVER['HTTP_HOST'];
 
     if (!$name) {
@@ -129,8 +133,8 @@ function _mimemail_file($file = NULL, $n
     return 'cid:'. $content_id;
   }
 
-  if ($file) {
-    return $file;
+  if ($url) {
+    return $url;
   }
 
   $ret = $files;
@@ -139,6 +143,37 @@ function _mimemail_file($file = NULL, $n
 }
 
 /**
+ * Helper function to convert a URL to a filesystem path.
+ *
+ * @param $url a URL to a file.
+ * @param $reldir If the URL is relative, make it relative to this path
+ *
+ * @return a relative path to the file, or NULL if it could not be converted.
+ */
+function _mimemail_url_to_file($url, $relpath = NULL) {
+  $url = urldecode($url);
+
+  $base_path = base_path();
+  if (substr($url, 0, strlen($base_path)) == $base_path) {
+    $path = substr($url, strlen($base_path));
+  } 
+  elseif ($relpath && !preg_match('#^(.*)://#', $url) && $url[0] != '/') {
+    $path = $relpath . $url;
+  }
+  else {
+    return NULL;
+  }
+
+  // Look for directory traversals taking us out of the working directory
+  if (in_array('..', explode('/', $path))) {
+    return NULL;
+  } 
+  else {
+    return $path;
+  }
+}
+
+/**
  *
  * @param $parts
  *        an array of parts to be included