Fix regression where printing/scaling/rotating image attachments was …

…broken (#9571)

CHANGELOG.md

@@ -2,6 +2,10 @@
 
 ## Unreleased
 
+- Fix regression where printing/scaling/rotating image attachments was broken (#9571)
+
+## Release 1.6.8
+
 - Managesieve: Protect special scripts in managesieve_kolab_master mode
 - Fix newmail_notifier notification focus in Chrome (#9467)
 - Fix fatal error when parsing some TNEF attachments (#9462)

program/js/app.js

@@ -407,13 +407,11 @@ function rcube_webmail()
               var contents = $(this).contents();
 
               // do not apply styles to an error page (with no image)
-              if (contents.find('img').length)
-                contents.find('head').append(
-                  '<style type="text/css">'
-                  + 'img { max-width:100%; max-height:100%; } ' // scale
-                  + 'body { display:flex; align-items:center; justify-content:center; height:100%; margin:0; }' // align
-                  + '</style>'
-                );
+              if (contents.find('img').length) {
+                contents.find('img').css({ maxWidth: '100%', maxHeight: '100%' });
+                contents.find('body').css({ display: 'flex', alignItems: 'center', justifyContent: 'center', height: '100%', margin: 0 });
+                contents.find('html').css({ height: '100%' });
+              }
             });
         }
         // show printing dialog unless decryption must be done first
@@ -5712,18 +5710,15 @@ function rcube_webmail()
   this.apply_image_style = function()
   {
     var style = [],
-      head = $(this.gui_objects.messagepartframe).contents().find('head');
-
-    $('#image-style', head).remove();
+      img = $(this.gui_objects.messagepartframe).contents().find('img');
 
     $.each({scale: '', rotate: 'deg'}, function(i, v) {
       var val = ref.image_style[i];
       if (val)
         style.push(i + '(' + val + v + ')');
     });
 
-    if (style)
-      head.append($('<style id="image-style">').text('img { transform: ' + style.join(' ') + '}'));
+    img.css('transform', style.join(' '));
   };
 
   // Update import dialog state

program/lib/Roundcube/rcube_output.php

@@ -286,7 +286,8 @@ public function download_headers($filename, $params = [])
         }
 
         // Use strict security policy to make sure no javascript content is executed
-        header("Content-Security-Policy: default-src 'none'");
+        // img-src is needed to be able to print attachment preview page
+        header("Content-Security-Policy: default-src 'none'; img-src 'self'");
 
         // don't kill the connection if download takes more than 30 sec.
         if (!array_key_exists('time_limit', $params)) {