Fix security issue in DBMail driver of password plugin (#1490261)

Aleksander Machniak

2015-02-05 f6336f7f7ec7e65290b6fde23b8fd64627fe15b8

 plugins/password/drivers/dbmail.php

@@ -20,10 +20,23 @@
    function save($currpass, $newpass)
    {
        $curdir   = RCUBE_PLUGINS_DIR . 'password/helpers';
        $username = escapeshellcmd($_SESSION['username']);
        $username = escapeshellarg($_SESSION['username']);
        $password = escapeshellarg($newpass);
        $args     = rcmail::get_instance()->config->get('password_dbmail_args', '');
        $command  = "$curdir/chgdbmailusers -c $username -w $password $args";

        exec("$curdir/chgdbmailusers -c $username -w $newpass $args", $output, $returnvalue);
        if (strlen($command) > 1024) {
            rcube::raise_error(array(
                'code' => 600,
                'type' => 'php',
                'file' => __FILE__, 'line' => __LINE__,
                'message' => "Password plugin: The command is too long."
                ), true, false);

            return PASSWORD_ERROR;
        }

        exec($command, $output, $returnvalue);

        if ($returnvalue == 0) {
            return PASSWORD_SUCCESS;