Fix HTTP User-Agent XSS vulnerability (#1488737)

Thomas Bruederli

2012-10-04 0ce66babed66c84cb8361e67b171fa65c1bab01a

Fix HTTP User-Agent XSS vulnerability (#1488737)

 program/steps/utils/error.inc

@@ -5,7 +5,7 @@
 | program/steps/utils/error.inc                                         |
 |                                                                       |
 | This file is part of the Roundcube Webmail client                     |
 | Copyright (C) 2005-2011, The Roundcube Dev Team                       |
 | Copyright (C) 2005-2012, The Roundcube Dev Team                       |
 |                                                                       |
 | Licensed under the GNU General Public License version 3 or            |
 | any later version with exceptions for skins & plugins.                |
@@ -25,11 +25,11 @@

// browser is not compatible with this application
if ($ERROR_CODE==409) {
  $user_agent = $_SERVER['HTTP_USER_AGENT'];
  $user_agent = htmlentities($_SERVER['HTTP_USER_AGENT']);
  $__error_title = 'Your browser does not suit the requirements for this application';
  $__error_text = <<<EOF
<i>Supported browsers:</i><br />
&raquo; &nbsp;Microsoft Internet Explorer 6+<br />
&raquo; &nbsp;Microsoft Internet Explorer 7+<br />
&raquo; &nbsp;Mozilla Firefox 3+<br />
&raquo; &nbsp;Chrome 10+<br />
&raquo; &nbsp;Safari 4+<br />