From bd0551b22076b82a6d49e9f7a2b2e0c90a1b2326 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Fri, 05 Feb 2016 07:25:27 -0500
Subject: [PATCH] Secure also downloads of addressbook exports, managesieve script exports and Enigma keys exports
---
program/steps/addressbook/export.inc | 43 +++++++++++++++++++++++++++++--------------
1 files changed, 29 insertions(+), 14 deletions(-)
diff --git a/program/steps/addressbook/export.inc b/program/steps/addressbook/export.inc
index 2b45e5c..c1eaa7f 100644
--- a/program/steps/addressbook/export.inc
+++ b/program/steps/addressbook/export.inc
@@ -1,6 +1,6 @@
<?php
-/*
+/**
+-----------------------------------------------------------------------+
| program/steps/addressbook/export.inc |
| |
@@ -20,6 +20,8 @@
| Author: Aleksander Machniak <machniak@kolabsys.com> |
+-----------------------------------------------------------------------+
*/
+
+$RCMAIL->request_security_check(rcube_utils::INPUT_GET);
// Use search result
if (!empty($_REQUEST['_search']) && isset($_SESSION['search'][$_REQUEST['_search']])) {
@@ -103,7 +105,9 @@
header('Content-Disposition: attachment; filename="contacts.vcf"');
while ($result && ($row = $result->next())) {
- prepare_for_export($row, $CONTACTS);
+ if ($CONTACTS) {
+ prepare_for_export($row, $CONTACTS);
+ }
// fix folding and end-of-line chars
$row['vcard'] = preg_replace('/\r|\n\s+/', '', $row['vcard']);
@@ -119,20 +123,23 @@
*/
function prepare_for_export(&$record, $source = null)
{
- $groups = $source && $source->groups && $source->export_groups ? $source->get_record_groups($record['ID']) : null;
+ $groups = $source && $source->groups && $source->export_groups ? $source->get_record_groups($record['ID']) : null;
+ $fieldmap = $source ? $source->vcard_map : null;
if (empty($record['vcard'])) {
- $vcard = new rcube_vcard();
- if ($source) {
- $vcard->extend_fieldmap($source->vcard_map);
- }
- $vcard->load($record['vcard']);
+ $vcard = new rcube_vcard($record['vcard'], RCUBE_CHARSET, false, $fieldmap);
$vcard->reset();
foreach ($record as $key => $values) {
list($field, $section) = explode(':', $key);
- foreach ((array)$values as $value) {
- if (is_array($value) || @strlen($value)) {
+ // avoid unwanted casting of DateTime objects to an array
+ // (same as in rcube_contacts::convert_save_data())
+ if (is_object($values) && is_a($values, 'DateTime')) {
+ $values = array($values);
+ }
+
+ foreach ((array) $values as $value) {
+ if (is_array($value) || is_a($value, 'DateTime') || @strlen($value)) {
$vcard->set($field, $value, strtoupper($section));
}
}
@@ -143,11 +150,19 @@
$vcard->set('groups', join(',', $groups), null);
}
- $record['vcard'] = $vcard->export(true);
+ $record['vcard'] = $vcard->export();
}
// patch categories to alread existing vcard block
- else if ($record['vcard'] && !empty($groups) && !strpos($record['vcard'], 'CATEGORIES:')) {
- $vgroups = 'CATEGORIES:' . rcube_vcard::vcard_quote(join(',', $groups));
- $record['vcard'] = str_replace('END:VCARD', $vgroups . rcube_vcard::$eol . 'END:VCARD', $record['vcard']);
+ else if ($record['vcard']) {
+ $vcard = new rcube_vcard($record['vcard'], RCUBE_CHARSET, false, $fieldmap);
+
+ // unset CATEGORIES entry, it might be not up-to-date (#1490277)
+ $vcard->set('groups', null);
+ $record['vcard'] = $vcard->export();
+
+ if (!empty($groups)) {
+ $vgroups = 'CATEGORIES:' . rcube_vcard::vcard_quote($groups, ',');
+ $record['vcard'] = str_replace('END:VCARD', $vgroups . rcube_vcard::$eol . 'END:VCARD', $record['vcard']);
+ }
}
}
--
Gitblit v1.9.1