Secure also downloads of addressbook exports, managesieve script exports an...

Aleksander Machniak

2016-02-05 bd0551b22076b82a6d49e9f7a2b2e0c90a1b2326

 program/steps/addressbook/photo.inc

@@ -1,6 +1,6 @@
<?php

/*
/**
 +-----------------------------------------------------------------------+
 | program/steps/addressbook/photo.inc                                   |
 |                                                                       |
@@ -80,16 +80,20 @@
    $RCMAIL->output->redirect($data);
}

// deliver alt image
if (!$data && ($alt_img = rcube_utils::get_input_value('_alt', rcube_utils::INPUT_GPC)) && is_file($alt_img)) {
    $data = file_get_contents($alt_img);
}

// cache for one day if requested by email
if (!$cid && $email) {
    $RCMAIL->output->future_expire_header(86400);
}

header('Content-Type: ' . rcube_mime::image_content_type($data));
echo $data ? $data : file_get_contents('program/resources/blank.gif');
if ($data) {
    header('Content-Type: ' . rcube_mime::image_content_type($data));
    echo $data;
}
else if (!empty($_GET['_error'])) {
    header('HTTP/1.0 404 Photo not found');
}
else {
    header('Content-Type: image/gif');
    echo base64_decode(rcmail_output::BLANK_GIF);
}
exit;