From b3ce7915610a6d272cc38ecd2a8b61e04ee4aeae Mon Sep 17 00:00:00 2001
From: thomascube <thomas@roundcube.net>
Date: Fri, 16 Feb 2007 14:35:03 -0500
Subject: [PATCH] Better input checking on GET and POST vars
---
program/steps/mail/func.inc | 10 +++++-----
1 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc
index 037e83f..ec257b6 100644
--- a/program/steps/mail/func.inc
+++ b/program/steps/mail/func.inc
@@ -30,16 +30,16 @@
}
// set imap properties and session vars
-if (strlen($mbox = get_input_value('_mbox', RCUBE_INPUT_GET)))
+if ($mbox = get_input_value('_mbox', RCUBE_INPUT_GPC))
{
$IMAP->set_mailbox($mbox);
$_SESSION['mbox'] = $mbox;
}
-if (strlen($_GET['_page']))
+if (!empty($_GET['_page']))
{
- $IMAP->set_page($_GET['_page']);
- $_SESSION['page'] = $_GET['_page'];
+ $IMAP->set_page((int)$_GET['_page']);
+ $_SESSION['page'] = (int)$_GET['_page'];
}
// set mailbox to INBOX if not set
@@ -59,7 +59,7 @@
// define url for getting message parts
if (strlen($_GET['_uid']))
- $GET_URL = sprintf('%s&_action=get&_mbox=%s&_uid=%d', $COMM_PATH, $IMAP->get_mailbox_name(), $_GET['_uid']);
+ $GET_URL = sprintf('%s&_action=get&_mbox=%s&_uid=%d', $COMM_PATH, $IMAP->get_mailbox_name(), get_input_value('_uid', RCUBE_INPUT_GET));
// set current mailbox in client environment
--
Gitblit v1.9.1