From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
program/steps/addressbook/copy.inc | 12 ++++++++----
1 files changed, 8 insertions(+), 4 deletions(-)
diff --git a/program/steps/addressbook/copy.inc b/program/steps/addressbook/copy.inc
index 5e526e1..59b4ffc 100644
--- a/program/steps/addressbook/copy.inc
+++ b/program/steps/addressbook/copy.inc
@@ -6,7 +6,10 @@
| |
| This file is part of the Roundcube Webmail client |
| Copyright (C) 2007, The Roundcube Dev Team |
- | Licensed under the GNU GPL |
+ | |
+ | Licensed under the GNU General Public License version 3 or |
+ | any later version with exceptions for skins & plugins. |
+ | See the README file for a full license statement. |
| |
| PURPOSE: |
| Copy a contact record from one direcotry to another |
@@ -14,9 +17,6 @@
+-----------------------------------------------------------------------+
| Author: Thomas Bruederli <roundcube@gmail.com> |
+-----------------------------------------------------------------------+
-
- $Id: copy.inc 471 2007-02-09 21:25:50Z thomasb $
-
*/
// only process ajax requests
@@ -57,6 +57,10 @@
foreach ($cid as $cid) {
$a_record = $CONTACTS->get_record($cid, true);
+ // avoid copying groups
+ if ($a_record['_type'] == 'group')
+ continue;
+
// Check if contact exists, if so, we'll need it's ID
// Note: Some addressbooks allows empty email address field
if (!empty($a_record['email']))
--
Gitblit v1.9.1