From ee883ad73d64639eb994a71e15b1a37c07ff3cb9 Mon Sep 17 00:00:00 2001
From: thomascube <thomas@roundcube.net>
Date: Fri, 22 Dec 2006 16:45:21 -0500
Subject: [PATCH] Applied security patches by Kees Cook (Ubuntu) + little visual enhancements
---
CHANGELOG | 9 +++++++++
program/steps/settings/delete_identity.inc | 4 ++--
program/blocked.gif | 0
program/include/main.inc | 20 ++++++++++++++++++++
skins/default/mail.css | 9 ++++++++-
program/steps/mail/func.inc | 7 ++++---
program/steps/addressbook/delete.inc | 4 ++--
program/steps/mail/sendmail.inc | 2 ++
8 files changed, 47 insertions(+), 8 deletions(-)
diff --git a/CHANGELOG b/CHANGELOG
index 8566f01..80afee4 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,15 @@
CHANGELOG RoundCube Webmail
---------------------------
+2006/12/22 (thomasb)
+----------
+- Applied security patch to validate the submitted host value (by Kees Cook)
+- Applied security patch to validate input values when deleting contacts (by Kees Cook)
+- Applied security patch that sanitizes emoticon paths when attaching them (by Kees Cook)
+- Applied a patch to more aggressively sanitize a HTML message
+- Visualize blocked images in HTML messages
+
+
2006/12/20 (thomasb)
----------
- Fixed wrong message listing when showing search results (closes #1484131)
diff --git a/program/blocked.gif b/program/blocked.gif
new file mode 100644
index 0000000..7a4aa9f
--- /dev/null
+++ b/program/blocked.gif
Binary files differ
diff --git a/program/include/main.inc b/program/include/main.inc
index c57aa8a..a1c00d3 100644
--- a/program/include/main.inc
+++ b/program/include/main.inc
@@ -450,6 +450,26 @@
if (!$host)
$host = $CONFIG['default_host'];
+ // Validate that selected host is in the list of configured hosts
+ if (is_array($CONFIG['default_host']))
+ {
+ $allowed = FALSE;
+ foreach ($CONFIG['default_host'] as $key => $host_allowed)
+ {
+ if (!is_numeric($key))
+ $host_allowed = $key;
+ if ($host == $host_allowed)
+ {
+ $allowed = TRUE;
+ break;
+ }
+ }
+ if (!$allowed)
+ return FALSE;
+ }
+ else if (!empty($CONFIG['default_host']) && $host != $CONFIG['default_host'])
+ return FALSE;
+
// parse $host URL
$a_host = parse_url($host);
if ($a_host['host'])
diff --git a/program/steps/addressbook/delete.inc b/program/steps/addressbook/delete.inc
index b95988d..3e33cd8 100644
--- a/program/steps/addressbook/delete.inc
+++ b/program/steps/addressbook/delete.inc
@@ -21,7 +21,7 @@
$REMOTE_REQUEST = TRUE;
-if ($_GET['_cid'])
+if ($_GET['_cid'] && preg_match('/^[0-9]+(,[0-9]+)*$/',$_GET['_cid']))
{
$DB->query("UPDATE ".get_table_name('contacts')."
SET del=1
@@ -96,4 +96,4 @@
}
exit;
-?>
\ No newline at end of file
+?>
diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc
index f01e95b..57f20e5 100644
--- a/program/steps/mail/func.inc
+++ b/program/steps/mail/func.inc
@@ -739,7 +739,7 @@
'/url\s*\(["\']?([\.\/]+[^"\'\s]+)["\']?\)/i',
'/<script.+<\/script>/Umis');
- $remote_replaces = array('<img \\1src=\\2./program/blank.gif\\4',
+ $remote_replaces = array('<img \\1src=\\2./program/blocked.gif\\4',
'',
'',
'',
@@ -1210,7 +1210,8 @@
}
// replace event handlers on any object
- $body = preg_replace('/\s(on[a-z]+)=/im', ' __removed=', $body);
+ $body = preg_replace('/\s(on[^=]+)=/im', ' __removed=', $body);
+ $body = preg_replace('/\shref=["\']?(javascript:)/im', 'null:', $body);
// resolve <base href>
$base_reg = '/(<base.*href=["\']?)([hftps]{3,5}:\/{2}[^"\'\s]+)([^<]*>)/i';
@@ -1251,7 +1252,7 @@
if (stristr((string)$attrib['href'], 'mailto:'))
$attrib['onclick'] = sprintf("return %s.command('compose','%s',this)",
$GLOBALS['JS_OBJECT_NAME'],
- substr($attrib['href'], 7));
+ JQ(substr($attrib['href'], 7)));
else if (!empty($attrib['href']) && $attrib['href']{0}!='#')
$attrib['target'] = '_blank';
diff --git a/program/steps/mail/sendmail.inc b/program/steps/mail/sendmail.inc
index 716072a..2d2cb33 100644
--- a/program/steps/mail/sendmail.inc
+++ b/program/steps/mail/sendmail.inc
@@ -100,6 +100,8 @@
$image_name = substr($body,
$pos + strlen($searchstr),
$pos2 - ($pos + strlen($searchstr)));
+ // sanitize image name so resulting attachment doesn't leave images dir
+ $image_name = preg_replace('/[^a-zA-Z0-9_\.\-]/i','',$image_name);
$body_post = substr($body, $pos2);
diff --git a/program/steps/settings/delete_identity.inc b/program/steps/settings/delete_identity.inc
index b8f9f52..24bf99c 100644
--- a/program/steps/settings/delete_identity.inc
+++ b/program/steps/settings/delete_identity.inc
@@ -21,7 +21,7 @@
$REMOTE_REQUEST = $_GET['_remote'] ? TRUE : FALSE;
-if ($_GET['_iid'])
+if ($_GET['_iid'] && preg_match('/^[0-9]+(,[0-9]+)*$/',$_GET['_iid']))
{
$DB->query("UPDATE ".get_table_name('identities')."
SET del=1
@@ -50,4 +50,4 @@
// overwrite action variable
$OUTPUT->add_script(sprintf("\n%s.set_env('action', '%s');", $JS_OBJECT_NAME, $_action));
-?>
\ No newline at end of file
+?>
diff --git a/skins/default/mail.css b/skins/default/mail.css
index eb0b525..479fb61 100644
--- a/skins/default/mail.css
+++ b/skins/default/mail.css
@@ -152,8 +152,15 @@
#messagepartframe
{
+ position: absolute;
+ top: 0px;
+ left: 0px;
+ right: 0px;
+ bottom: 0px;
+ width: auto;
+ height: auto;
border: 1px solid #999999;
- background-color: #F9F9F9;
+ background-color: #F9F9F9;
}
--
Gitblit v1.9.1