From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
plugins/password/drivers/dbmail.php | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/plugins/password/drivers/dbmail.php b/plugins/password/drivers/dbmail.php
index a7c2f46..e4c0d52 100644
--- a/plugins/password/drivers/dbmail.php
+++ b/plugins/password/drivers/dbmail.php
@@ -19,7 +19,7 @@
{
function password_save($currpass, $newpass)
{
- $curdir = INSTALL_PATH . 'plugins/password/helpers';
+ $curdir = RCUBE_PLUGINS_DIR . 'password/helpers';
$username = escapeshellcmd($_SESSION['username']);
$args = rcmail::get_instance()->config->get('password_dbmail_args', '');
--
Gitblit v1.9.1