From bd0551b22076b82a6d49e9f7a2b2e0c90a1b2326 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Fri, 05 Feb 2016 07:25:27 -0500
Subject: [PATCH] Secure also downloads of addressbook exports, managesieve script exports and Enigma keys exports
---
program/lib/Roundcube/rcube_session.php | 10 +++++++---
1 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/program/lib/Roundcube/rcube_session.php b/program/lib/Roundcube/rcube_session.php
index 23b1d33..f0c012c 100644
--- a/program/lib/Roundcube/rcube_session.php
+++ b/program/lib/Roundcube/rcube_session.php
@@ -219,7 +219,9 @@
{
// move gc execution to the script shutdown function
// see rcube::shutdown() and rcube_session::write_close()
- return $this->gc_enabled = $maxlifetime;
+ $this->gc_enabled = $maxlifetime;
+
+ return true;
}
/**
@@ -293,6 +295,8 @@
/**
* Append the given value to the certain node in the session data array
*
+ * Warning: Do not use if you already modified $_SESSION in the same request (#1490608)
+ *
* @param string Path denoting the session variable where to append the value
* @param string Key name under which to append the new value (use null for appending to an indexed list)
* @param mixed Value to append to the session data array
@@ -319,8 +323,9 @@
$this->appends[] = $path;
// when overwriting a previously unset variable
- if ($this->unsets[$path])
+ if ($this->unsets[$path]) {
unset($this->unsets[$path]);
+ }
}
/**
@@ -398,7 +403,6 @@
}
}
}
-
}
/**
--
Gitblit v1.9.1