Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

Aleksander Machniak

2013-10-17 037af6890fe6fdb84a08d3c86083e847c90ec0ad

 skins/larry/templates/contactedit.html

@@ -18,11 +18,15 @@

   <div id="contactphoto">
      <roundcube:object name="contactphoto" id="contactpic" placeholder="/images/contactpic.png" />
      <roundcube:if condition="env:photocol" />
      <roundcube:object name="fileDropArea" id="contactpic" />
      <div class="formlinks">
         <roundcube:button command="upload-photo" id="uploadformlink" type="link" label="replacephoto" class="iconlink upload disabled" classAct="iconlink upload active" onclick="UI.show_uploadform();return false" condition="env:photocol" /><br/>
         <roundcube:button command="delete-photo" type="link" label="delete" class="iconlink delete disabled" classAct="iconlink delete active" condition="env:photocol" />
      </div>
      <roundcube:endif />
   </div>

   <roundcube:object name="contactedithead" id="contacthead" size="16" form="editform" />
   <br style="clear:both" />

@@ -32,13 +36,13 @@

</form>

<div id="headerbuttons" class="formbuttons">
<div class="footerleft formbuttons">
   <roundcube:button command="save" type="input" class="button mainaction" label="save" />
   <roundcube:button command="show" type="input" class="button" label="cancel" condition="env:action=='edit'" />
   <roundcube:button name="cancel" type="input" class="button" label="cancel" onclick="history.back()" condition="env:action=='add'" />
</div>

<div id="upload-dialog" class="propform popupdialog">
<div id="upload-dialog" class="propform popupdialog" title="<roundcube:label name='uploadphoto' />">
   <roundcube:object name="photoUploadForm" id="upload-form" size="30" buttons="no" />
   <div class="formbuttons">
      <roundcube:button command="upload-photo" type="input" class="button mainaction" label="upload" />