View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0006172 | SOGo | with SOGo | public | 2026-01-19 08:45 | 2026-01-19 08:47 |
| Reporter | cdmon | Assigned To | |||
| Priority | normal | Severity | minor | Reproducibility | always |
| Status | new | Resolution | open | ||
| Platform | [Server] Linux | OS | Ubuntu | OS Version | 16.04 LTS |
| Product Version | 5.12.4 | ||||
| Summary | 0006172: HTML sanitizer removes clickable area for newsletters using <a> wrapping <table> | ||||
| Description | We are SOGo administrators and have received multiple user reports regarding newsletters from well-known companies and media outlets where “Read more” buttons or large clickable areas are not clickable in SOGo, while they work as expected in other mail clients such as Roundcube, Thunderbird, and Gmail. After analysis, this behavior is caused by SOGo sanitizing HTML patterns where an <a> element wraps a block-level <table>. When sanitized, the anchor is removed or neutralized, leaving visually styled buttons (usually <td> elements) without an actual <a href> inside, making them non-clickable. Technically, the HTML in these newsletters is not ideal, as the button text itself is not wrapped in an anchor. Instead, the layout relies on a parent <a> element wrapping a table. Other mail clients apply heuristic rendering and still make the area clickable. SOGo, correctly prioritizing security and standards, does not. However, from an operational and user-experience perspective, this leads to a recurring issue: Minimal example (simplified) <a href="https://example.com"> After sanitization, the <a> is removed or detached, leaving a styled <td> without a clickable link. | ||||
| Steps To Reproduce | Sent the eml file attached to the issue. | ||||
| Tags | No tags attached. | ||||