From bd0551b22076b82a6d49e9f7a2b2e0c90a1b2326 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Fri, 05 Feb 2016 07:25:27 -0500
Subject: [PATCH] Secure also downloads of addressbook exports, managesieve script exports and Enigma keys exports
---
program/steps/addressbook/photo.inc | 10 ++++------
1 files changed, 4 insertions(+), 6 deletions(-)
diff --git a/program/steps/addressbook/photo.inc b/program/steps/addressbook/photo.inc
index 962ca31..1d3d950 100644
--- a/program/steps/addressbook/photo.inc
+++ b/program/steps/addressbook/photo.inc
@@ -1,6 +1,6 @@
<?php
-/*
+/**
+-----------------------------------------------------------------------+
| program/steps/addressbook/photo.inc |
| |
@@ -80,11 +80,6 @@
$RCMAIL->output->redirect($data);
}
-// deliver alt image
-if (!$data && ($alt_img = rcube_utils::get_input_value('_alt', rcube_utils::INPUT_GPC)) && is_file($alt_img)) {
- $data = file_get_contents($alt_img);
-}
-
// cache for one day if requested by email
if (!$cid && $email) {
$RCMAIL->output->future_expire_header(86400);
@@ -94,6 +89,9 @@
header('Content-Type: ' . rcube_mime::image_content_type($data));
echo $data;
}
+else if (!empty($_GET['_error'])) {
+ header('HTTP/1.0 404 Photo not found');
+}
else {
header('Content-Type: image/gif');
echo base64_decode(rcmail_output::BLANK_GIF);
--
Gitblit v1.9.1