From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

---
 program/steps/settings/edit_folder.inc |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/program/steps/settings/edit_folder.inc b/program/steps/settings/edit_folder.inc
index cd23727..fdb38e6 100644
--- a/program/steps/settings/edit_folder.inc
+++ b/program/steps/settings/edit_folder.inc
@@ -78,7 +78,7 @@
 
     // Location (name)
     if ($options['protected']) {
-        $foldername = Q(str_replace($delimiter, ' &raquo; ', rcmail_localize_folderpath($mbox_imap)));
+        $foldername = str_replace($delimiter, ' &raquo; ', Q(rcmail_localize_folderpath($mbox_imap)));
     }
     else if ($options['norename']) {
         $foldername = Q($folder);

--
Gitblit v1.9.1