From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
plugins/managesieve/tests/Parser.php | 14 +++++++++++---
1 files changed, 11 insertions(+), 3 deletions(-)
diff --git a/plugins/managesieve/tests/Parser.php b/plugins/managesieve/tests/Parser.php
index 06b644b..9050f09 100644
--- a/plugins/managesieve/tests/Parser.php
+++ b/plugins/managesieve/tests/Parser.php
@@ -5,7 +5,7 @@
function setUp()
{
- include_once dirname(__FILE__) . '/../lib/rcube_sieve_script.php';
+ include_once dirname(__FILE__) . '/../lib/Roundcube/rcube_sieve_script.php';
}
/**
@@ -15,7 +15,15 @@
*/
function test_parser($input, $output, $message)
{
- $script = new rcube_sieve_script($input);
+ // get capabilities list from the script
+ $caps = array();
+ if (preg_match('/require \[([a-z0-9", ]+)\]/', $input, $m)) {
+ foreach (explode(',', $m[1]) as $cap) {
+ $caps[] = trim($cap, '" ');
+ }
+ }
+
+ $script = new rcube_sieve_script($input, $caps);
$result = $script->as_text();
$this->assertEquals(trim($result), trim($output), $message);
@@ -31,7 +39,7 @@
$result = array();
while ($file = readdir($dir)) {
- if (preg_match('/^[a-z_]+$/', $file)) {
+ if (preg_match('/^[a-z0-9_]+$/', $file)) {
$input = file_get_contents($dir_path . '/' . $file);
if (file_exists($dir_path . '/' . $file . '.out')) {
--
Gitblit v1.9.1