From b3ce7915610a6d272cc38ecd2a8b61e04ee4aeae Mon Sep 17 00:00:00 2001
From: thomascube <thomas@roundcube.net>
Date: Fri, 16 Feb 2007 14:35:03 -0500
Subject: [PATCH] Better input checking on GET and POST vars
---
program/steps/mail/folders.inc | 8 ++++----
1 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/program/steps/mail/folders.inc b/program/steps/mail/folders.inc
index 2d16032..1b7007c 100644
--- a/program/steps/mail/folders.inc
+++ b/program/steps/mail/folders.inc
@@ -25,10 +25,10 @@
// send EXPUNGE command
if ($_action=='expunge')
{
- $success = $IMAP->expunge($_GET['_mbox']);
+ $success = $IMAP->expunge(get_input_value('_mbox', RCUBE_INPUT_GET));
// reload message list if current mailbox
- if ($success && $_GET['_reload'])
+ if ($success && !empty($_GET['_reload']))
{
rcube_remote_response('this.message_list.clear();', TRUE);
$_action = 'list';
@@ -41,9 +41,9 @@
// clear mailbox
else if ($_action=='purge')
{
- $success = $IMAP->clear_mailbox($_GET['_mbox']);
+ $success = $IMAP->clear_mailbox(get_input_value('_mbox', RCUBE_INPUT_GET));
- if ($success && $_GET['_reload'])
+ if ($success && !empty($_GET['_reload']))
{
$commands = "this.message_list.clear();\n";
$commands .= "this.set_env('messagecount', 0);\n";
--
Gitblit v1.9.1