Backport XSS vulnerability fix to 0.5 branch

thomascube

2011-08-12 58fc995728352b466f166a67281b11f6db191f31

 program/include/rcube_json_output.php

@@ -169,12 +169,16 @@
    public function show_message($message, $type='notice', $vars=null, $override=true)
    {
        if ($override || !$this->message) {
            if (rcube_label_exists($message)) {
                if (!empty($vars))
                    $vars = array_map('Q', $vars);
                $msgtext = rcube_label(array('name' => $message, 'vars' => $vars));
            }
            else
                $msgtext = $message;

            $this->message = $message;
            $this->command(
                'display_message',
                rcube_label(array('name' => $message, 'vars' => $vars)),
                $type
            );
            $this->command('display_message', $msgtext, $type, $timeout * 1000);
        }
    }

@@ -237,7 +241,11 @@
        unset($this->env['task'], $this->env['action'], $this->env['comm_path']);

        $rcmail = rcmail::get_instance();
        $response = array('action' => $rcmail->action, 'unlock' => get_input_value('_unlock', RCUBE_INPUT_GPC));
        $response['action'] = $rcmail->action;

        if ($unlock = get_input_value('_unlock', RCUBE_INPUT_GPC)) {
            $response['unlock'] = $unlock;
        }

        if (!empty($this->env))
            $response['env'] = $this->env;