From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
plugins/zipdownload/zipdownload.php | 14 +++++++-------
1 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/plugins/zipdownload/zipdownload.php b/plugins/zipdownload/zipdownload.php
index 8bad9b3..443fef7 100644
--- a/plugins/zipdownload/zipdownload.php
+++ b/plugins/zipdownload/zipdownload.php
@@ -30,9 +30,9 @@
}
$rcmail = rcmail::get_instance();
- $this->charset = $rcmail->config->get('zipdownload_charset', RCMAIL_CHARSET);
$this->load_config();
+ $this->charset = $rcmail->config->get('zipdownload_charset', RCUBE_CHARSET);
$this->add_texts('localization');
if ($rcmail->config->get('zipdownload_attachments', 1) > -1 && ($rcmail->action == 'show' || $rcmail->action == 'preview'))
@@ -105,7 +105,7 @@
foreach ($message->attachments as $part) {
$pid = $part->mime_id;
$part = $message->mime_parts[$pid];
- $disp_name = $this->_convert_filename($part->filename, $part->charset);
+ $disp_name = $this->_convert_filename($part->filename);
if ($part->body) {
$orig_message_raw = $part->body;
@@ -208,7 +208,7 @@
$disp_name = "message_rfc822.eml";
$disp_name = $uid . "_" . $disp_name;
-
+
$tmpfn = tempnam($temp_dir, 'zipmessage');
$tmpfp = fopen($tmpfn, 'w');
$imap->get_raw_body($uid, $tmpfp);
@@ -258,10 +258,10 @@
/**
* Helper function to convert filenames to the configured charset
*/
- private function _convert_filename($str, $from = RCMAIL_CHARSET)
+ private function _convert_filename($str)
{
- return strtr(rcube_charset_convert($str, $from, $this->charset), array(':'=>'', '/'=>'-'));
+ $str = rcube_charset::convert($str, RCUBE_CHARSET, $this->charset);
+
+ return strtr($str, array(':'=>'', '/'=>'-'));
}
}
-
-?>
\ No newline at end of file
--
Gitblit v1.9.1