Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

Aleksander Machniak

2013-10-17 037af6890fe6fdb84a08d3c86083e847c90ec0ad

 skins/larry/templates/login.html

@@ -21,10 +21,13 @@

<div class="box-bottom">
   <roundcube:object name="message" id="message" />
   <noscript>
      <p class="noscriptwarning"><roundcube:label name="noscriptwarning" /></p>
   </noscript>
</div>

<div id="bottomline">
   Roundcube Webmail <roundcube:object name="version" />
   <roundcube:var name="config:product_name"> <roundcube:object name="version" condition="config:display_version" />
   <roundcube:if condition="config:support_url" />
      &nbsp;&#9679;&nbsp; <a href="<roundcube:var name='config:support_url' />" target="_blank" class="support-link"><roundcube:label name="support" /></a>
   <roundcube:endif />
@@ -34,5 +37,18 @@

<roundcube:include file="/includes/footer.html" />

<roundcube:object name="preloader" images="
  /images/ajaxloader.gif
  /images/buttons.png
  /images/addcontact.png
  /images/filetypes.png
  /images/listicons.png
  /images/messages.png
  /images/quota.png
  /images/selector.png
  /images/splitter.png
  /images/watermark.jpg
" />

</body>
</html>