Fix bugs where CSRF attacks were still possible on some requests

Aleksander Machniak

2014-12-15 376cbfd4f2dfcf455717409b70d9d056cbeb08b1

 plugins/acl/acl.js

@@ -14,6 +14,11 @@
                var inst = rcmail.is_framed() ? parent.rcmail : rcmail;
                inst.init_address_input_events($('#acluser'), {action:'settings/plugin.acl-autocomplete'});

                // pass config settings and localized texts to autocomplete context
                inst.set_env({ autocomplete_max:rcmail.env.autocomplete_max, autocomplete_min_length:rcmail.env.autocomplete_min_length });
                inst.add_label('autocompletechars', rcmail.labels.autocompletechars);
                inst.add_label('autocompletemore', rcmail.labels.autocompletemore);

                // fix inserted value
                inst.addEventListener('autocomplete_insert', function(e) {
                    if (e.field.id != 'acluser')
@@ -57,8 +62,11 @@
    var users = this.acl_get_usernames();

    if (users && users.length && confirm(this.get_label('acl.deleteconfirm'))) {
        this.http_request('settings/plugin.acl', '_act=delete&_user='+urlencode(users.join(','))
            + '&_mbox='+urlencode(this.env.mailbox),
        this.http_post('settings/plugin.acl', {
                _act: 'delete',
                _user: users.join(','),
                _mbox: this.env.mailbox
            },
            this.set_busy(true, 'acl.deleting'));
    }
}
@@ -66,7 +74,7 @@
// Save ACL data
rcube_webmail.prototype.acl_save = function()
{
    var user = $('#acluser', this.acl_form).val(), rights = '', type;
    var data, type, rights = '', user = $('#acluser', this.acl_form).val();

    $((this.env.acl_advanced ? '#advancedrights :checkbox' : '#simplerights :checkbox'), this.acl_form).map(function() {
        if (this.checked)
@@ -87,12 +95,18 @@
        return;
    }

    this.http_request('settings/plugin.acl', '_act=save'
        + '&_user='+urlencode(user)
        + '&_acl=' +rights
        + '&_mbox='+urlencode(this.env.mailbox)
        + (this.acl_id ? '&_old='+this.acl_id : ''),
        this.set_busy(true, 'acl.saving'));
    data = {
        _act: 'save',
        _user: user,
        _acl: rights,
        _mbox: this.env.mailbox
    }

    if (this.acl_id) {
        data._old = this.acl_id;
    }

    this.http_post('settings/plugin.acl', data, this.set_busy(true, 'acl.saving'));
}

// Cancel/Hide form