Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

Aleksander Machniak

2013-10-17 037af6890fe6fdb84a08d3c86083e847c90ec0ad

 plugins/password/drivers/virtualmin.php

@@ -48,10 +48,10 @@
            $pieces = explode("_", $username);
            $domain = $pieces[0];
            break;
      case 8: // domain taken from alias, username left as it was
         $email = $rcmail->user->data['alias'];
         $domain = substr(strrchr($email, "@"), 1);
         break;
        case 8: // domain taken from alias, username left as it was
            $email = $rcmail->user->data['alias'];
            $domain = substr(strrchr($email, "@"), 1);
            break;
        default: // username@domain
            $domain = substr(strrchr($username, "@"), 1);
        }