The transcoding of a mail (transforming CSS into inline styles on the
element nodes of the mail) used the form:
property:value;
So when a mail is saved, it would be eg. with `style="property:value;"`
and when it is being edited "property:value" is removed if available via
CSS stylesheet given the structure.
But the sanitize_style (introduced in bfe7aafa7) adds an espace before
the value (which is more pretty but was probably not choosen in
transcoding to decrease size of mail):
property: value;
so the inline style would not be removed when editing possibly causing
conflict with the editor.
With this commit, the sanitize_style doesn't add a space. It could have
been changed in transcoding but the code is already rather slow and we
don't want to use a regex replace or two string replace instead of the
current one string replace.
opw-1841107
For the purpose of fighting spam, many abuse/spam-fighting
services provide redacted message IDs. Because we use a UNIX
timestamp as the prefix for all message IDs, a redacted
message ID of the form 1234XXXXX@domain.com is generally
useless to find a `flagged` message's origin, because it
matches most of the messages sent that day.
Narrowing it down with the help of the approximate time
of delivery does not help much, as there will still be
dozens/hundreds of possible matches on a busy server.
By swapping around the random token and the timestamp in
the message ID, we should improve the uniqueness and
"greppability" of our message IDs, once redacted.
lxml.html.clean module we are using to sanitize html takes either a
tree/element or string, and return us an element of the same type.
We are passing it an unicode string, and it gives us back an unicode
string and if it is possible convert entities to utf-8.
This lead to an issue in html inline fields containing an ` `
entity, the entity was converted by the sanitizer to its unicode
character (U+00A0).
Then, when the field value is loaded to be displayed, the internal
value contains U+00A0 characters, but when it is inserted in the page
the browser converts them to ` `. Hence in this instance, the
internal value is never equal to the displayed value and a write is
always triggered even without editing.
This commit simple modify the sanitizer so value saved in database
contain ` `.
closes#14569
opw-689274
Christophe Simonis