From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
program/steps/mail/addcontact.inc | 16 ++--------------
1 files changed, 2 insertions(+), 14 deletions(-)
diff --git a/program/steps/mail/addcontact.inc b/program/steps/mail/addcontact.inc
index 7476811..3805577 100644
--- a/program/steps/mail/addcontact.inc
+++ b/program/steps/mail/addcontact.inc
@@ -17,26 +17,14 @@
+-----------------------------------------------------------------------+
| Author: Thomas Bruederli <roundcube@gmail.com> |
+-----------------------------------------------------------------------+
-
- $Id$
-
*/
// only process ajax requests
if (!$OUTPUT->ajax_call)
return;
-$abook = $RCMAIL->config->get('default_addressbook');
-
-// Get configured addressbook
-$CONTACTS = $RCMAIL->get_address_book($abook, true);
-
-// Get first writeable addressbook if the configured doesn't exist
-// This can happen when user deleted the addressbook (e.g. Kolab folder)
-if ($abook == null || !is_object($CONTACTS)) {
- $source = reset($RCMAIL->get_address_sources(true));
- $CONTACTS = $RCMAIL->get_address_book($source['id'], true);
-}
+// Get default addressbook
+$CONTACTS = $RCMAIL->get_address_book(-1, true);
if (!empty($_POST['_address']) && is_object($CONTACTS))
{
--
Gitblit v1.9.1