From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
program/steps/addressbook/copy.inc | 7 ++++---
1 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/program/steps/addressbook/copy.inc b/program/steps/addressbook/copy.inc
index 40b2a79..59b4ffc 100644
--- a/program/steps/addressbook/copy.inc
+++ b/program/steps/addressbook/copy.inc
@@ -17,9 +17,6 @@
+-----------------------------------------------------------------------+
| Author: Thomas Bruederli <roundcube@gmail.com> |
+-----------------------------------------------------------------------+
-
- $Id: copy.inc 471 2007-02-09 21:25:50Z thomasb $
-
*/
// only process ajax requests
@@ -60,6 +57,10 @@
foreach ($cid as $cid) {
$a_record = $CONTACTS->get_record($cid, true);
+ // avoid copying groups
+ if ($a_record['_type'] == 'group')
+ continue;
+
// Check if contact exists, if so, we'll need it's ID
// Note: Some addressbooks allows empty email address field
if (!empty($a_record['email']))
--
Gitblit v1.9.1