Protect download urls against CSRF using unique request tokens (#1490642) S...

Thomas Bruederli

2016-01-16 699af1e5206ed9114322adaa3c25c1c969640a53

 plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php

@@ -63,7 +63,7 @@
        1 => 'notifyimportancehigh'
    );

    const VERSION  = '8.3';
    const VERSION  = '8.4';
    const PROGNAME = 'Roundcube (Managesieve)';
    const PORT     = 4190;

@@ -397,6 +397,8 @@
                }
            }
            else if ($action == 'setget') {
                $this->rc->request_security_check(rcube_utils::INPUT_GET);

                $script_name = rcube_utils::get_input_value('_set', rcube_utils::INPUT_GPC, true);
                $script      = $this->sieve->get_script($script_name);

@@ -440,6 +442,11 @@
                $content = $this->action_div($fid, $id, false);

                $this->rc->output->command('managesieve_actionfill', $content, $id, $aid);
            }
            else if ($action == 'addresses') {
                $aid = rcube_utils::get_input_value('_aid', rcube_utils::INPUT_POST);

                $this->rc->output->command('managesieve_vacation_addresses_update', $aid, $this->user_emails());
            }

            $this->rc->output->send();
@@ -1769,7 +1776,10 @@
            . "</textarea>\n";

        // vacation
        $vsec = in_array('vacation-seconds', $this->exts);
        $vsec      = in_array('vacation-seconds', $this->exts);
        $auto_addr = $this->rc->config->get('managesieve_vacation_addresses_init');
        $addresses = isset($action['addresses']) || !$auto_addr ? (array) $action['addresses'] : $this->user_emails();

        $out .= '<div id="action_vacation' .$id.'" style="display:' .($action['type']=='vacation' ? 'inline' : 'none') .'">';
        $out .= '<span class="label">'. rcube::Q($this->plugin->gettext('vacationreason')) .'</span><br />'
            .'<textarea name="_action_reason['.$id.']" id="action_reason' .$id. '" '
@@ -1780,8 +1790,10 @@
            .'value="' . (is_array($action['subject']) ? rcube::Q(implode(', ', $action['subject']), 'strict', false) : $action['subject']) . '" size="35" '
            . $this->error_class($id, 'action', 'subject', 'action_subject') .' />';
        $out .= '<br /><span class="label">' .rcube::Q($this->plugin->gettext('vacationaddr')) . '</span><br />'
            . $this->list_input($id, 'action_addresses', $action['addresses'], true,
                $this->error_class($id, 'action', 'addresses', 'action_addresses'), 30);
            . $this->list_input($id, 'action_addresses', $addresses, true,
                $this->error_class($id, 'action', 'addresses', 'action_addresses'), 30)
            . html::a(array('href' => '#', 'onclick' => rcmail_output::JS_OBJECT_NAME . ".managesieve_vacation_addresses($id)"),
                rcube::Q($this->plugin->gettext('filladdresses')));
        $out .= '<br /><span class="label">' . rcube::Q($this->plugin->gettext($vsec ? 'vacationinterval' : 'vacationdays')) . '</span><br />'
            .'<input type="text" name="_action_interval['.$id.']" id="action_interval'.$id.'" '
            .'value="' .rcube::Q(rcube_sieve_vacation::vacation_interval($action), 'strict', false) . '" size="2" '
@@ -2389,4 +2401,21 @@

        $this->headers += $headers;
    }

    /**
     * Get all e-mail addresses of the user
     */
    protected function user_emails()
    {
        $addresses = $this->rc->user->list_emails();

        foreach ($addresses as $idx => $email) {
            $addresses[$idx] = $email['email'];
        }

        $addresses = array_unique($addresses);
        sort($addresses);

        return $addresses;
    }
}