Fix XSS issue in href attribute on area tag (#5240, #5241)

Aleksander Machniak

2016-05-06 acf633c73bc8df9a5036bc52d7568f4213ab73c7

 index.php

@@ -2,9 +2,9 @@
/*
 +-------------------------------------------------------------------------+
 | Roundcube Webmail IMAP Client                                           |
 | Version 1.0-rc                                                          |
 | Version 1.0.9                                                           |
 |                                                                         |
 | Copyright (C) 2005-2013, The Roundcube Dev Team                         |
 | Copyright (C) 2005-2014, The Roundcube Dev Team                         |
 |                                                                         |
 | This program is free software: you can redistribute it and/or modify    |
 | it under the terms of the GNU General Public License (with exceptions   |
@@ -172,6 +172,7 @@

// end session (after optional referer check)
else if ($RCMAIL->task == 'logout' && isset($_SESSION['user_id'])
    && $RCMAIL->check_request(rcube_utils::INPUT_GET)
    && (!$RCMAIL->config->get('referer_check') || rcube_utils::check_referer())
) {
    $userdata = array(
@@ -211,7 +212,7 @@
        $OUTPUT->show_message('sessionerror', 'error', null, true, -1);
    }

    if ($OUTPUT->ajax_call || !empty($_REQUEST['_framed'])) {
    if ($OUTPUT->ajax_call || $OUTPUT->get_env('framed')) {
        $OUTPUT->command('session_error', $RCMAIL->url(array('_err' => 'session')));
        $OUTPUT->send('iframe');
    }