Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

Aleksander Machniak

2013-10-17 037af6890fe6fdb84a08d3c86083e847c90ec0ad

 skins/larry/templates/compose.html

@@ -39,6 +39,13 @@
<!-- inline address book -->
<div id="compose-contacts" class="uibox listbox">
<h2 class="boxtitle"><roundcube:label name="contacts" /></h2>
   <div id="composequicksearch">
      <div class="searchbox">
         <roundcube:object name="searchform" id="contactsearchbox" />
         <a id="searchmenulink" class="iconbutton searchoptions"> </a>
         <roundcube:button command="reset-search" id="searchreset" class="iconbutton reset" title="resetsearch" content=" " />
      </div>
   </div>
   <roundcube:object name="addressbooks" id="directorylist" class="listing" />
   <div class="scroller withfooter">
      <roundcube:object name="addresslist" id="contacts-table" class="listing" noheader="true" />
@@ -136,9 +143,11 @@
   <span class="composeoption">
      <label><roundcube:object name="dsnCheckBox" form="form" id="rcmcomposedsn" /> <roundcube:label name="dsn" /></label>
   </span>
   <roundcube:if condition="!config:no_save_sent_messages" />
   <span class="composeoption">
      <label><roundcube:label name="savesentmessagein" /> <roundcube:object name="storetarget" maxlength="30" style="max-width:12em" /></label>
   </span>
   <roundcube:endif />
   <roundcube:container name="composeoptions" id="composeoptions" />
</div>