From 1608f432826a41e035ee7ddb0dd409bbcf559b43 Mon Sep 17 00:00:00 2001
From: thomascube <thomas@roundcube.net>
Date: Wed, 24 Dec 2008 09:19:27 -0500
Subject: [PATCH] Secure bin scripts by requiring a valid session and replace preg_replace(/../e) with preg_replace_callback
---
bin/modcss.php | 10 +++++++---
1 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/bin/modcss.php b/bin/modcss.php
index 08da367..d0a3cc9 100644
--- a/bin/modcss.php
+++ b/bin/modcss.php
@@ -20,10 +20,12 @@
*/
define('INSTALL_PATH', realpath(dirname(__FILE__) . '/..') . '/');
-require INSTALL_PATH.'program/include/iniset.php';
+require INSTALL_PATH . 'program/include/iniset.php';
+
+$RCMAIL = rcmail::get_instance();
$source = "";
-if ($url = preg_replace('/[^a-z0-9.-_\?\$&=%]/i', '', $_GET['u']))
+if (!empty($RCMAIL->user->ID) && ($url = preg_replace('/[^a-z0-9.-_\?\$&=%]/i', '', $_GET['u'])))
{
$a_uri = parse_url($url);
$port = $a_uri['port'] ? $a_uri['port'] : 80;
@@ -59,7 +61,9 @@
header("Content-Type: text/css");
echo rcmail_mod_css_styles($source, preg_replace('/[^a-z0-9]/i', '', $_GET['c']), $url);
}
-else
+else {
header("HTTP/1.0 404 Not Found");
+ echo "Requires a valid user session and source url";
+}
?>
--
Gitblit v1.9.1