From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
skins/larry/templates/message.html | 21 ++++++++++++++++-----
1 files changed, 16 insertions(+), 5 deletions(-)
diff --git a/skins/larry/templates/message.html b/skins/larry/templates/message.html
index 50ac844..0179b6b 100644
--- a/skins/larry/templates/message.html
+++ b/skins/larry/templates/message.html
@@ -4,7 +4,7 @@
<title><roundcube:object name="pagetitle" /></title>
<roundcube:include file="/includes/links.html" />
</head>
-<body class="noscroll">
+<roundcube:if condition="env:extwin" /><body class="noscroll extwin"><roundcube:else /><body class="noscroll"><roundcube:endif />
<roundcube:include file="/includes/header.html" />
@@ -12,30 +12,41 @@
<!-- toolbar -->
<div id="messagetoolbar" class="toolbar fullwidth">
+<roundcube:if condition="!env:extwin" />
<roundcube:button command="list" type="link" class="button back disabled" classAct="button back" classSel="button back pressed" label="back" />
- <span class="spacer"></span>
+<roundcube:endif />
<roundcube:include file="/includes/mailtoolbar.html" />
<div class="toolbarselect">
<roundcube:object name="mailboxlist" type="select" noSelection="moveto" maxlength="25" onchange="rcmail.command('moveto', this.options[this.selectedIndex].value)" class="mailboxlist decorated" folder_filter="mail" />
</div>
</div>
+<roundcube:if condition="!env:extwin" />
+
<div id="mailview-left">
<!-- folders list -->
<div id="mailboxcontainer" class="uibox listbox">
<div class="scroller">
-<roundcube:object name="mailboxlist" id="mailboxlist" class="listing" folder_filter="mail" unreadwrap="%s" />
+<roundcube:object name="mailboxlist" id="mailboxlist" class="treelist listing" folder_filter="mail" unreadwrap="%s" />
</div>
</div>
</div>
<div id="mailview-right" class="offset uibox">
+<roundcube:else />
+
+<div id="mailview-right" class="offset fullwidth uibox">
+<roundcube:endif />
<div id="messageheader">
+<span class="moreheaderstoggle"></span>
+
<h2 class="subject"><roundcube:object name="messageHeaders" valueOf="subject" /></h2>
-<roundcube:object name="messageHeaders" class="headers-table" addicon="/images/addcontact.png" exclude="subject" />
+<div class="message-headers">
+<roundcube:object name="messageHeaders" class="headers-table" addicon="/images/addcontact.png" exclude="subject" max="20" />
+</div>
<roundcube:object name="messageFullHeaders" id="full-headers" />
<!-- record navigation -->
@@ -54,7 +65,7 @@
</div>
<div class="leftcol">
<roundcube:object name="messageObjects" id="message-objects" />
-<roundcube:object name="messageBody" id="messagebody" />
+<roundcube:object name="messageBody" id="messagebody" headertableclass="message-partheaders headers-table" />
</div>
</div>
--
Gitblit v1.9.1