diff --git a/CHANGELOG b/CHANGELOG
index c6637e47cff..2d7f74bd999 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -53,6 +53,7 @@ CHANGELOG Roundcube Webmail
- Fix decoding of mailto: links with + character in HTML messages (#6020)
- Fix false reporting of failed upgrade in installto.sh (#6019)
- Fix file disclosure vulnerability caused by insuficient input validation in relation to attachment plugins (#6026)
+- Fix mangled non-ASCII characters in links in HTML messages (#6028)
RELEASE 1.3.2
-------------
diff --git a/program/lib/Roundcube/html.php b/program/lib/Roundcube/html.php
index ffb0493019c..eea6a2f04ba 100644
--- a/program/lib/Roundcube/html.php
+++ b/program/lib/Roundcube/html.php
@@ -349,7 +349,10 @@ public static function attrib_string($attrib = array(), $allowed = null)
public static function parse_attrib_string($str)
{
$attrib = array();
- $html = '';
+ $html = ''
+ . ''
+ . ''
+ . '';
$document = new DOMDocument('1.0', RCUBE_CHARSET);
@$document->loadHTML($html);
diff --git a/tests/Framework/Html.php b/tests/Framework/Html.php
index edc3466b078..8507477c22b 100644
--- a/tests/Framework/Html.php
+++ b/tests/Framework/Html.php
@@ -117,6 +117,10 @@ function data_parse_attrib_string()
'expression="test == true ? \' test\' : \'\'" ',
array('expression' => 'test == true ? \' test\' : \'\''),
),
+ array(
+ 'href="http://domain.tld/страница"',
+ array('href' => 'http://domain.tld/страница'),
+ ),
);
}