From 8dd172a5b0e8050dc109b6bdb5850e5eef6d7a84 Mon Sep 17 00:00:00 2001
From: alecpl <alec@alec.pl>
Date: Tue, 09 Aug 2011 14:40:42 -0400
Subject: [PATCH] - Fix XSS vulnerability in UI messages (#1488030)
---
CHANGELOG | 1 +
program/include/rcube_json_output.php | 9 ++++++++-
program/include/rcube_template.php | 9 ++++++++-
3 files changed, 17 insertions(+), 2 deletions(-)
diff --git a/CHANGELOG b/CHANGELOG
index 39b7991..bfaf6b0 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,7 @@
CHANGELOG Roundcube Webmail
===========================
+- Fix XSS vulnerability in UI messages (#1488030)
- Fix handling of email addresses with quoted local part (#1487939)
- Fix EOL character in vCard exports (#1487873)
- Added optional "multithreading" autocomplete feature
diff --git a/program/include/rcube_json_output.php b/program/include/rcube_json_output.php
index 40a7b2a..ade9cc0 100644
--- a/program/include/rcube_json_output.php
+++ b/program/include/rcube_json_output.php
@@ -174,8 +174,15 @@
public function show_message($message, $type='notice', $vars=null, $override=true, $timeout=0)
{
if ($override || !$this->message) {
+ if (rcube_label_exists($message)) {
+ if (!empty($vars))
+ $vars = array_map('Q', $vars);
+ $msgtext = rcube_label(array('name' => $message, 'vars' => $vars));
+ }
+ else
+ $msgtext = $message;
+
$this->message = $message;
- $msgtext = rcube_label_exists($message) ? rcube_label(array('name' => $message, 'vars' => $vars)) : $message;
$this->command('display_message', $msgtext, $type, $timeout * 1000);
}
}
diff --git a/program/include/rcube_template.php b/program/include/rcube_template.php
index 6228e76..b9a43d3 100755
--- a/program/include/rcube_template.php
+++ b/program/include/rcube_template.php
@@ -248,8 +248,15 @@
public function show_message($message, $type='notice', $vars=null, $override=true, $timeout=0)
{
if ($override || !$this->message) {
+ if (rcube_label_exists($message)) {
+ if (!empty($vars))
+ $vars = array_map('Q', $vars);
+ $msgtext = rcube_label(array('name' => $message, 'vars' => $vars));
+ }
+ else
+ $msgtext = $message;
+
$this->message = $message;
- $msgtext = rcube_label_exists($message) ? rcube_label(array('name' => $message, 'vars' => $vars)) : $message;
$this->command('display_message', $msgtext, $type, $timeout * 1000);
}
}
--
Gitblit v1.9.1