From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
skins/larry/templates/folders.html | 19 ++++++++++++++-----
1 files changed, 14 insertions(+), 5 deletions(-)
diff --git a/skins/larry/templates/folders.html b/skins/larry/templates/folders.html
index 385d268..988ff95 100644
--- a/skins/larry/templates/folders.html
+++ b/skins/larry/templates/folders.html
@@ -4,7 +4,7 @@
<title><roundcube:object name="pagetitle" /></title>
<roundcube:include file="/includes/links.html" />
</head>
-<body>
+<body class="noscroll">
<roundcube:include file="/includes/header.html" />
@@ -12,23 +12,32 @@
<roundcube:include file="/includes/settingstabs.html" />
+<div id="settings-right">
+
<div id="folderslist" class="uibox listbox">
-<h2 class="boxtitle"><span style="float:right"><roundcube:label name="subscribed" /></span><roundcube:label name="folders" /></h2>
-<div class="scroller withfooter">
+<h2 id="folderslist-header" class="boxtitle"><span style="float:right"><roundcube:label name="subscribed" /></span><roundcube:label name="folders" /></h2>
+<div id="folderslist-content" class="scroller withfooter">
<roundcube:object name="foldersubscription" form="subscriptionform" id="subscription-table" class="listing" noheader="true" />
</div>
-<div class="boxfooter">
+<div id="folderslist-footer" class="boxfooter">
<roundcube:button command="create-folder" type="link" title="createfolder" class="listbutton add disabled" classAct="listbutton add" innerClass="inner" content="+" /><roundcube:button name="mailboxmenulink" id="mailboxmenulink" type="link" title="folderactions" class="listbutton groupactions" onclick="UI.show_popup('mailboxmenu');return false" innerClass="inner" content="⚙" />
+ <roundcube:if condition="env:quota" />
+ <roundcube:object name="quotaDisplay" id="quotadisplay" class="countdisplay" display="text" />
+ <roundcube:endif />
</div>
</div>
<div id="folder-details" class="uibox contentbox">
- <roundcube:object name="folderframe" id="preferences-frame" style="width:100%; height:96%" src="/watermark.html" />
+ <div class="iframebox">
+ <roundcube:object name="folderframe" id="preferences-frame" style="width:100%; height:100%" frameborder="0" src="/watermark.html" />
+ </div>
<roundcube:object name="message" id="message" class="statusbar" />
</div>
</div>
+</div>
+
<div id="mailboxmenu" class="popupmenu">
<ul class="toolbarmenu" id="mailboxoptionsmenu">
<li><roundcube:button command="delete-folder" label="delete" classAct="active" /></li>
--
Gitblit v1.9.1