From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

---
 plugins/acl/skins/larry/templates/table.html |   17 +++++++----------
 1 files changed, 7 insertions(+), 10 deletions(-)

diff --git a/plugins/acl/skins/larry/templates/table.html b/plugins/acl/skins/larry/templates/table.html
index c8dff81..3cf8292 100644
--- a/plugins/acl/skins/larry/templates/table.html
+++ b/plugins/acl/skins/larry/templates/table.html
@@ -3,20 +3,17 @@
     <roundcube:object name="acltable" id="acltable" class="records-table" />
 </div>
 <div id="acllist-footer" class="boxfooter">
-    <roundcube:button command="acl-create" id="aclcreatelink" type="link" title="acl.newuser" class="listbutton add disabled" classAct="listbutton add" innerClass="inner" content="+" /><roundcube:button name="aclmenulink" id="aclmenulink" type="link" title="acl.actions" class="listbutton groupactions"onclick="UI.show_popup('aclmenu');return false" innerClass="inner" content="&#9881;" />
-    <roundcube:if condition="!in_array('acl_advanced_mode', (array)config:dont_override)" />
-        <span class="countdisplay" style="display: inline">
-        <label for="acl-switch"><roundcube:label name="acl.advanced" /></label>
-        <input type="checkbox" id="acl-switch" onclick="rcmail.command('acl-mode-switch')"<roundcube:exp expression="config:acl_advanced_mode == true ? ' checked=checked' : ''" /> />
-        </span>
-    <roundcube:endif />
+    <roundcube:button command="acl-create" id="aclcreatelink" type="link" title="acl.newuser" class="listbutton add disabled" classAct="listbutton add" innerClass="inner" content="+" /><roundcube:button name="aclmenulink" id="aclmenulink" type="link" title="acl.actions" class="listbutton groupactions"onclick="UI.show_popup('aclmenu', undefined, {above:1});return false" innerClass="inner" content="&#9881;" />
 </div>
 </div>
 
 <div id="aclmenu" class="popupmenu">
-    <ul class="toolbarmenu">
-        <li><roundcube:button command="acl-edit" label="edit" classAct="active" /></li>
-        <li><roundcube:button command="acl-delete" label="delete" classAct="active" /></li>
+    <ul class="toolbarmenu selectable iconized">
+        <li><roundcube:button command="acl-edit" label="edit" class="icon" classAct="icon active" innerclass="icon edit" /></li>
+        <li><roundcube:button command="acl-delete" label="delete" class="icon" classAct="icon active" innerclass="icon delete" /></li>
+        <roundcube:if condition="!in_array('acl_advanced_mode', (array)config:dont_override)" />
+            <li><roundcube:button name="acl-switch" id="acl-switch" label="acl.advanced" onclick="rcmail.command('acl-mode-switch')" class="active" /></li>
+        <roundcube:endif />
     </ul>
 </div>
 

--
Gitblit v1.9.1