Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

Aleksander Machniak

2013-10-17 037af6890fe6fdb84a08d3c86083e847c90ec0ad

 program/steps/mail/mark.inc

@@ -5,7 +5,10 @@
 |                                                                       |
 | This file is part of the Roundcube Webmail client                     |
 | Copyright (C) 2005-2009, The Roundcube Dev Team                       |
 | Licensed under the GNU GPL                                            |
 |                                                                       |
 | Licensed under the GNU General Public License version 3 or            |
 | any later version with exceptions for skins & plugins.                |
 | See the README file for a full license statement.                     |
 |                                                                       |
 | PURPOSE:                                                              |
 |   Mark the submitted messages with the specified flag                 |
@@ -13,9 +16,6 @@
 +-----------------------------------------------------------------------+
 | Author: Thomas Bruederli <roundcube@gmail.com>                        |
 +-----------------------------------------------------------------------+

 $Id$

*/

// only process ajax requests
@@ -113,24 +113,21 @@
      $OUTPUT->command('set_rowcount', rcmail_get_messagecount_text($msg_count), $mbox);

      if ($threading) {
       $count = get_input_value('_count', RCUBE_INPUT_POST);
        $count = get_input_value('_count', RCUBE_INPUT_POST);
      }

      // add new rows from next page (if any)
      if ($count && $uids != '*' && ($jump_back || $nextpage_count > 0)) {
        $sort_col   = isset($_SESSION['sort_col'])   ? $_SESSION['sort_col']   : $CONFIG['message_sort_col'];
        $sort_order = isset($_SESSION['sort_order']) ? $_SESSION['sort_order'] : $CONFIG['message_sort_order'];

        $a_headers = $RCMAIL->storage->list_messages($mbox, NULL, $sort_col, $sort_order,
       $jump_back ? NULL : $count);
        $a_headers = $RCMAIL->storage->list_messages($mbox, NULL,
          rcmail_sort_column(), rcmail_sort_order(), $jump_back ? NULL : $count);

        rcmail_js_message_list($a_headers, false);
      }
    }
  }

  $OUTPUT->send();
}
else {
    $OUTPUT->show_message('internalerror', 'error');
}

exit;

$OUTPUT->send();