From ed1d212ae2daea5e4bd043417610177093e99f19 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Sat, 16 Jan 2016 03:03:51 -0500
Subject: [PATCH] Improved SVG cleanup code
---
program/include/rcmail_output_html.php | 27 +++++++++++++++++++--------
1 files changed, 19 insertions(+), 8 deletions(-)
diff --git a/program/include/rcmail_output_html.php b/program/include/rcmail_output_html.php
index 365c403..f602010 100644
--- a/program/include/rcmail_output_html.php
+++ b/program/include/rcmail_output_html.php
@@ -1,6 +1,6 @@
<?php
-/*
+/**
+-----------------------------------------------------------------------+
| program/include/rcmail_output_html.php |
| |
@@ -18,7 +18,6 @@
| Author: Thomas Bruederli <roundcube@gmail.com> |
+-----------------------------------------------------------------------+
*/
-
/**
* Class to create HTML page output using a skin template
@@ -225,6 +224,17 @@
*/
public function set_skin($skin)
{
+ // Sanity check to prevent from path traversal vulnerability (#1490620)
+ if (strpos($skin, '/') !== false || strpos($skin, "\\") !== false) {
+ rcube::raise_error(array(
+ 'file' => __FILE__,
+ 'line' => __LINE__,
+ 'message' => 'Invalid skin name'
+ ), true, false);
+
+ return false;
+ }
+
$valid = false;
$path = RCUBE_INSTALL_PATH . 'skins/';
@@ -263,11 +273,14 @@
$meta = @file_get_contents(RCUBE_INSTALL_PATH . $skin_path . '/meta.json');
$meta = @json_decode($meta, true);
- $meta['path'] = $skin_path;
- $skin_id = end(explode('/', $skin_path));
+ $meta['path'] = $skin_path;
+ $path_elements = explode('/', $skin_path);
+ $skin_id = end($path_elements);
+
if (!$meta['name']) {
$meta['name'] = $skin_id;
}
+
$this->skins[$skin_id] = $meta;
if ($meta['extends']) {
@@ -389,7 +402,7 @@
if ($override || !$this->message) {
if ($this->app->text_exists($message)) {
if (!empty($vars))
- $vars = array_map('Q', $vars);
+ $vars = array_map(array('rcube','Q'), $vars);
$msgtext = $this->app->gettext(array('name' => $message, 'vars' => $vars));
}
else
@@ -957,7 +970,7 @@
"rcube_utils::get_input_value('\\1', rcube_utils::INPUT_GPC)",
"\$_COOKIE['\\1']",
"\$browser->{'\\1'}",
- $this->template_name,
+ "'" . $this->template_name . "'",
),
$expression
);
@@ -1257,7 +1270,6 @@
if (!($attrib['command'] || $attrib['name'] || $attrib['href'])) {
return '';
}
-
// try to find out the button type
if ($attrib['type']) {
@@ -2035,5 +2047,4 @@
return $content;
}
-
}
--
Gitblit v1.9.1