From ee883ad73d64639eb994a71e15b1a37c07ff3cb9 Mon Sep 17 00:00:00 2001
From: thomascube <thomas@roundcube.net>
Date: Fri, 22 Dec 2006 16:45:21 -0500
Subject: [PATCH] Applied security patches by Kees Cook (Ubuntu) + little visual enhancements
---
program/steps/mail/sendmail.inc | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/program/steps/mail/sendmail.inc b/program/steps/mail/sendmail.inc
index 716072a..2d2cb33 100644
--- a/program/steps/mail/sendmail.inc
+++ b/program/steps/mail/sendmail.inc
@@ -100,6 +100,8 @@
$image_name = substr($body,
$pos + strlen($searchstr),
$pos2 - ($pos + strlen($searchstr)));
+ // sanitize image name so resulting attachment doesn't leave images dir
+ $image_name = preg_replace('/[^a-zA-Z0-9_\.\-]/i','',$image_name);
$body_post = substr($body, $pos2);
--
Gitblit v1.9.1