From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

---
 program/include/bc.php |   20 +++++++++++++++++++-
 1 files changed, 19 insertions(+), 1 deletions(-)

diff --git a/program/include/bc.php b/program/include/bc.php
index 40524be..af2e512 100644
--- a/program/include/bc.php
+++ b/program/include/bc.php
@@ -23,6 +23,7 @@
  * Roundcube Webmail deprecated functions
  *
  * @package Core
+ * @subpackage Legacy
  * @author Thomas Bruederli <roundcube@gmail.com>
  */
 
@@ -286,7 +287,7 @@
 
 function rcube_check_referer()
 {
-    return rcmail::check_referer();
+    return rcube_utils::check_referer();
 }
 
 function rcube_timer()
@@ -398,3 +399,20 @@
 {
     return rcube_utils::get_boolean($str);
 }
+
+function enriched_to_html($data)
+{
+    return rcube_enriched::to_html($data);
+}
+
+class rcube_html_page extends rcmail_html_page
+{
+}
+
+class washtml extends rcube_washtml
+{
+}
+
+class html2text extends rcube_html2text
+{
+}

--
Gitblit v1.9.1