I have a very similar issue. However, mine never seem to load and it potentially brings the server to a standstill.
I also upgraded my SugarCRM Professional instance from 6.2.3 to 6.3.0 in hope to fix this issue to no avail.
Unfortunately I don't know of any SugarCRM settings to enable text-only mode (would be nice!).
I believe the fault resides in function clean_xss() found in utils.php. It is called in file ./modules/Emails/Email.php, function safeText().
Looks like it's hanging on the following code:
Code:
$jsMatches = xss_check_pattern($attribute_regex, $str);
I assume something isn't happy with the regex expression. Once expanded...
Code:
xss_check_pattern('#<.+(onblur|onfocus|oncontextmenu|onresize|onscroll|onunload|ondblclick|onclick|onmouseup|onmouseover|onmousedown|onmouseenter|onmouseleave|onmousemove|onload|onchange|onreset|onselect|onsubmit|onkeydown|onkeypress|onkeyup|onabort|onerror|ondragdrop)[^=>]*=[^>]*>#sim', $str); I'm not familiar enough with regex to optimise. In utils.php there's a note saying:
Code:
// cn: bug 13079 - "on\w" matched too many non-events (cONTact, strONG, etc.)
I used "on\w" as a base of my "fix". Instead of using "on\w", I went effectively with "\Won\w".
Original code:
Code:
$attribute_regex = "#<.+({$jsEvents})[^=>]*=[^>]*>#sim"; My replacement code:
Code:
$attribute_regex = "#<.+[^A-Z]on[A-Z][^=>]*=[^>]*>#sim";
For a 55KB Outlook-generated email, loading still took considerable time (over 35 seconds on an idle server!) however it's better than not having it load at all.
SugarCRM may be able to use something like HTML Purifier to process and filter HTML content. It looks like that idea was suggested many years ago...
http://www.sugarcrm.com/forums/f22/s...ourself-16522/
(however, with my very limited testing, HTML Purifier stripped a lot of the MS Office code)
Or apply the XSS filters when not dealing with already archived emails (XSS should be removed prior to insertion into the database; if XSS filter updates are made, apply it once again during the software upgrade process to all currently stored emails).
Any suggestions to better optimise the regex or make different code changes, I'd be happy to hear!
@nmuleski, @plehry:
How large are the emails you're trying to load when the load times are long?
I performed the suggestion by plehry and wow, did it make a difference!!!
Before (with my code changes):
Code:
Server response time: 33.36 seconds.
After (with my code changes, all sections minimised):
Code:
Server response time: 5.47 seconds.
After (with original code, all sections minimised):
Code:
Server response time: 119.36 seconds.
You can see how bad it would perform if all tabs were expanded!!
The code definitely needs assessing. Not just the regex expression but the inner workings. I can't see any reason why the same bit of code (filtering the archived email) is run so many times. I think the email is still processed more than once with all tabs closed -- I would help but Sugar code drives me nuts; for the most part I don't understand what is going on.
Bookmarks