From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
program/lib/Roundcube/rcube_plugin.php | 8 ++++++++
1 files changed, 8 insertions(+), 0 deletions(-)
diff --git a/program/lib/Roundcube/rcube_plugin.php b/program/lib/Roundcube/rcube_plugin.php
index 66e77cc..34720cf 100644
--- a/program/lib/Roundcube/rcube_plugin.php
+++ b/program/lib/Roundcube/rcube_plugin.php
@@ -60,6 +60,14 @@
*/
public $noframe = false;
+ /**
+ * A list of config option names that can be modified
+ * by the user via user interface (with save-prefs command)
+ *
+ * @var array
+ */
+ public $allowed_prefs;
+
protected $home;
protected $urlbase;
private $mytask;
--
Gitblit v1.9.1