From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
program/steps/mail/list.inc | 37 +++++++++++++++++++++----------------
1 files changed, 21 insertions(+), 16 deletions(-)
diff --git a/program/steps/mail/list.inc b/program/steps/mail/list.inc
index b5d579d..b8c3ee0 100644
--- a/program/steps/mail/list.inc
+++ b/program/steps/mail/list.inc
@@ -23,27 +23,33 @@
return;
}
+$save_arr = array();
+$dont_override = (array) $RCMAIL->config->get('dont_override');
+
// is there a sort type for this request?
-if ($sort = get_input_value('_sort', RCUBE_INPUT_GET))
-{
+if ($sort = get_input_value('_sort', RCUBE_INPUT_GET)) {
// yes, so set the sort vars
list($sort_col, $sort_order) = explode('_', $sort);
// set session vars for sort (so next page and task switch know how to sort)
- $save_arr = array();
- $_SESSION['sort_col'] = $save_arr['message_sort_col'] = $sort_col;
- $_SESSION['sort_order'] = $save_arr['message_sort_order'] = $sort_order;
+ if (!in_array('message_sort_col', $dont_override)) {
+ $_SESSION['sort_col'] = $save_arr['message_sort_col'] = $sort_col;
+ }
+ if (!in_array('message_sort_order', $dont_override)) {
+ $_SESSION['sort_order'] = $save_arr['message_sort_order'] = $sort_order;
+ }
}
// is there a set of columns for this request?
-if ($cols = get_input_value('_cols', RCUBE_INPUT_GET))
-{
- $save_arr = array();
- $save_arr['list_cols'] = explode(',', $cols);
+if ($cols = get_input_value('_cols', RCUBE_INPUT_GET)) {
+ if (!in_array('list_cols', $dont_override)) {
+ $save_arr['list_cols'] = explode(',', $cols);
+ }
}
-if ($save_arr)
+if (!empty($save_arr)) {
$RCMAIL->user->save_prefs($save_arr);
+}
$mbox_name = $RCMAIL->storage->get_folder();
$threading = (bool) $RCMAIL->storage->get_threading();
@@ -52,8 +58,7 @@
$RCMAIL->storage->folder_sync($mbox_name);
// initialize searching result if search_filter is used
-if ($_SESSION['search_filter'] && $_SESSION['search_filter'] != 'ALL')
-{
+if ($_SESSION['search_filter'] && $_SESSION['search_filter'] != 'ALL') {
$search_request = md5($mbox_name.$_SESSION['search_filter']);
$RCMAIL->storage->search($mbox_name, $_SESSION['search_filter'], RCMAIL_CHARSET, rcmail_sort_column());
$_SESSION['search'] = $RCMAIL->storage->get_search_set();
@@ -76,7 +81,6 @@
$RCMAIL->session->remove('search');
}
-
// empty result? we'll skip UNSEEN counting in rcmail_send_unread_count()
if (empty($search_request) && empty($a_headers)) {
$unseen = 0;
@@ -91,15 +95,16 @@
$OUTPUT->set_env('pagecount', $pages);
$OUTPUT->set_env('threading', $threading);
$OUTPUT->set_env('current_page', $count ? $RCMAIL->storage->get_page() : 1);
+$OUTPUT->set_env('exists', $RCMAIL->storage->count($mbox_name, 'EXISTS'));
$OUTPUT->command('set_rowcount', rcmail_get_messagecount_text($count), $mbox_name);
$OUTPUT->command('set_mailboxname', rcmail_get_mailbox_name_text());
// add message rows
rcmail_js_message_list($a_headers, FALSE, $cols);
-if (isset($a_headers) && count($a_headers))
-{
- if ($search_request)
+if (isset($a_headers) && count($a_headers)) {
+ if ($search_request) {
$OUTPUT->show_message('searchsuccessful', 'confirmation', array('nr' => $count));
+ }
}
else {
// handle IMAP errors (e.g. #1486905)
--
Gitblit v1.9.1