From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
plugins/managesieve/lib/Net/Sieve.php | 4 +++-
1 files changed, 3 insertions(+), 1 deletions(-)
diff --git a/plugins/managesieve/lib/Net/Sieve.php b/plugins/managesieve/lib/Net/Sieve.php
index a8e36d8..8a0a9b0 100644
--- a/plugins/managesieve/lib/Net/Sieve.php
+++ b/plugins/managesieve/lib/Net/Sieve.php
@@ -1098,7 +1098,9 @@
return PEAR::raiseError(trim($response . $line), 6);
}
- if (preg_match('/^{([0-9]+)}/i', $line, $matches)) {
+ // "\+?" is added in the regexp to workaround DBMail bug
+ // http://dbmail.org/mantis/view.php?id=963
+ if (preg_match('/^{([0-9]+)\+?}/i', $line, $matches)) {
// Matches literal string responses.
$line = $this->_recvBytes($matches[1] + 2);
--
Gitblit v1.9.1