From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
plugins/additional_message_headers/additional_message_headers.php | 46 ++++++++++++++++++++++++++++++++++++++++++++++
1 files changed, 46 insertions(+), 0 deletions(-)
diff --git a/plugins/additional_message_headers/additional_message_headers.php b/plugins/additional_message_headers/additional_message_headers.php
new file mode 100644
index 0000000..43f9d00
--- /dev/null
+++ b/plugins/additional_message_headers/additional_message_headers.php
@@ -0,0 +1,46 @@
+<?php
+
+/**
+ * Additional Message Headers
+ *
+ * Very simple plugin which will add additional headers
+ * to or remove them from outgoing messages.
+ *
+ * Enable the plugin in config/main.inc.php and add your desired headers:
+ * $rcmail_config['additional_message_headers'] = array('User-Agent');
+ *
+ * @version @package_version@
+ * @author Ziba Scott
+ * @website http://roundcube.net
+ */
+class additional_message_headers extends rcube_plugin
+{
+ function init()
+ {
+ $this->add_hook('message_before_send', array($this, 'message_headers'));
+ }
+
+ function message_headers($args)
+ {
+ $this->load_config();
+
+ $headers = $args['message']->headers();
+ $rcube = rcube::get_instance();
+
+ // additional email headers
+ $additional_headers = $rcube->config->get('additional_message_headers', array());
+ foreach ((array)$additional_headers as $header => $value) {
+ if (null === $value) {
+ unset($headers[$header]);
+ }
+ else {
+ $headers[$header] = $value;
+ }
+ }
+
+ $args['message']->_headers = array();
+ $args['message']->headers($headers);
+
+ return $args;
+ }
+}
--
Gitblit v1.9.1