From 54be5ccb50be664ca4cc30fab6fb84e7be8e223e Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Fri, 08 Jun 2012 03:23:32 -0400
Subject: [PATCH] Fix XSS vulnerability in message subject handling using Larry skin (#1488519)
---
CHANGELOG | 1 +
program/steps/mail/func.inc | 2 +-
2 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/CHANGELOG b/CHANGELOG
index 2248129..0c39534 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,7 @@
CHANGELOG Roundcube Webmail
===========================
+- Fix XSS vulnerability in message subject handling using Larry skin (#1488519)
- Fix handling of links with various URI schemes e.g. "skype:" (#1488106)
- Fix handling of links inside PRE elements on html to text conversion
- Fix indexing of links on html to text conversion
diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc
index 1e5dbda..7417c6b 100644
--- a/program/steps/mail/func.inc
+++ b/program/steps/mail/func.inc
@@ -947,7 +947,7 @@
// single header value is requested
if (!empty($attrib['valueof']))
- return Q($plugin['output'][$attrib['valueof']]['value'], ($hkey == 'subject' ? 'strict' : 'show'));
+ return Q($plugin['output'][$attrib['valueof']]['value'], ($attrib['valueof'] == 'subject' ? 'strict' : 'show'));
// compose html table
$table = new html_table(array('cols' => 2));
--
Gitblit v1.9.1