From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
program/steps/addressbook/show.inc | 7 +++++--
1 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/program/steps/addressbook/show.inc b/program/steps/addressbook/show.inc
index 16be89f..494f06a 100644
--- a/program/steps/addressbook/show.inc
+++ b/program/steps/addressbook/show.inc
@@ -215,15 +215,18 @@
$checkbox = new html_checkbox(array('name' => '_gid[]',
'class' => 'groupmember', 'disabled' => $CONTACTS->readonly));
- foreach ($GROUPS as $group) {
+ foreach (array_merge($GROUPS, $members) as $group) {
$gid = $group['ID'];
+ if ($seen[$gid]++)
+ continue;
+
$table->add(null, $checkbox->show($members[$gid] ? $gid : null,
array('value' => $gid, 'id' => 'ff_gid' . $gid)));
$table->add(null, html::label('ff_gid' . $gid, Q($group['name'])));
}
$hiddenfields = new html_hiddenfield(array('name' => '_source', 'value' => get_input_value('_source', RCUBE_INPUT_GPC)));
- $hiddenfields->add(array('name' => '_cid', 'value' => $record['ID']));
+ $hiddenfields->add(array('name' => '_cid', 'value' => $contact_id));
$form_start = $RCMAIL->output->request_form(array(
'name' => "form", 'method' => "post",
--
Gitblit v1.9.1