From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
program/steps/mail/show.inc | 10 +++++++---
1 files changed, 7 insertions(+), 3 deletions(-)
diff --git a/program/steps/mail/show.inc b/program/steps/mail/show.inc
index b01989a..dbb6d21 100644
--- a/program/steps/mail/show.inc
+++ b/program/steps/mail/show.inc
@@ -255,9 +255,13 @@
if ($email) {
// @TODO: search in all address books?
$CONTACTS = $RCMAIL->get_address_book(-1, true);
- $existing = $CONTACTS->search('email', $email, true, false);
- if ($existing->count)
- return true;
+
+ if (is_object($CONTACTS)) {
+ $existing = $CONTACTS->search('email', $email, true, false);
+ if ($existing->count) {
+ return true;
+ }
+ }
}
return false;
--
Gitblit v1.9.1