Protect download urls against CSRF using unique request tokens (#1490642) S...

Thomas Bruederli

2016-01-16 699af1e5206ed9114322adaa3c25c1c969640a53

 plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php

@@ -63,7 +63,7 @@
        1 => 'notifyimportancehigh'
    );

    const VERSION  = '8.1';
    const VERSION  = '8.4';
    const PROGNAME = 'Roundcube (Managesieve)';
    const PORT     = 4190;

@@ -122,9 +122,6 @@
                case rcube_sieve::ERROR_CONNECTION:
                case rcube_sieve::ERROR_LOGIN:
                    $this->rc->output->show_message('managesieve.filterconnerror', 'error');
                    rcube::raise_error(array('code' => 403, 'type' => 'php',
                        'file' => __FILE__, 'line' => __LINE__,
                        'message' => "Unable to connect to managesieve on $host:$port"), true, false);
                    break;

                default:
@@ -210,7 +207,18 @@
            $plugin['socket_options']
        );

        return $this->sieve->error();
        $error = $this->sieve->error();

        if ($error) {
            rcube::raise_error(array(
                    'code'    => 403,
                    'file'    => __FILE__,
                    'line'    => __LINE__,
                    'message' => "Unable to connect to managesieve on $host:$port"
                ), true, false);
        }

        return $error;
    }

    /**
@@ -220,7 +228,7 @@
     *
     * @return int Connection status: 0 on success, >0 on failure
     */
    public function load_script($script_name = null)
    protected function load_script($script_name = null)
    {
        // Get list of scripts
        $list = $this->list_scripts();
@@ -389,11 +397,14 @@
                }
            }
            else if ($action == 'setget') {
                $script_name = rcube_utils::get_input_value('_set', rcube_utils::INPUT_GPC, true);
                $script = $this->sieve->get_script($script_name);
                $this->rc->request_security_check(rcube_utils::INPUT_GET);

                if (PEAR::isError($script))
                $script_name = rcube_utils::get_input_value('_set', rcube_utils::INPUT_GPC, true);
                $script      = $this->sieve->get_script($script_name);

                if (is_a($script, 'PEAR_Error')) {
                    exit;
                }

                $browser = new rcube_browser;

@@ -431,6 +442,11 @@
                $content = $this->action_div($fid, $id, false);

                $this->rc->output->command('managesieve_actionfill', $content, $id, $aid);
            }
            else if ($action == 'addresses') {
                $aid = rcube_utils::get_input_value('_aid', rcube_utils::INPUT_POST);

                $this->rc->output->command('managesieve_vacation_addresses_update', $aid, $this->user_emails());
            }

            $this->rc->output->send();
@@ -1393,19 +1409,21 @@
        }

        if (isset($rule['test'])) {
            if (in_array($rule['test'], array('header', 'address', 'envelope'))
                && !is_array($rule['arg1'])
                && ($header = strtolower($rule['arg1']))
                && isset($this->headers[$header])
            ) {
                $test = $header;
            if (in_array($rule['test'], array('header', 'address', 'envelope'))) {
                if (is_array($rule['arg1']) && count($rule['arg1']) == 1) {
                    $rule['arg1'] = $rule['arg1'][0];
                }

                $matches = ($header = strtolower($rule['arg1'])) && isset($this->headers[$header]);
                $test    = $matches ? $header : '...';
            }
            else if ($rule['test'] == 'exists'
                && !is_array($rule['arg'])
                && ($header = strtolower($rule['arg']))
                && isset($this->headers[$header])
            ) {
                $test = $header;
            else if ($rule['test'] == 'exists') {
                if (is_array($rule['arg']) && count($rule['arg']) == 1) {
                    $rule['arg'] = $rule['arg'][0];
                }

                $matches = ($header = strtolower($rule['arg'])) && isset($this->headers[$header]);
                $test    = $matches ? $header : '...';
            }
            else if (in_array($rule['test'], array('size', 'body', 'date', 'currentdate'))) {
                $test = $rule['test'];
@@ -1758,7 +1776,10 @@
            . "</textarea>\n";

        // vacation
        $vsec = in_array('vacation-seconds', $this->exts);
        $vsec      = in_array('vacation-seconds', $this->exts);
        $auto_addr = $this->rc->config->get('managesieve_vacation_addresses_init');
        $addresses = isset($action['addresses']) || !$auto_addr ? (array) $action['addresses'] : $this->user_emails();

        $out .= '<div id="action_vacation' .$id.'" style="display:' .($action['type']=='vacation' ? 'inline' : 'none') .'">';
        $out .= '<span class="label">'. rcube::Q($this->plugin->gettext('vacationreason')) .'</span><br />'
            .'<textarea name="_action_reason['.$id.']" id="action_reason' .$id. '" '
@@ -1769,11 +1790,13 @@
            .'value="' . (is_array($action['subject']) ? rcube::Q(implode(', ', $action['subject']), 'strict', false) : $action['subject']) . '" size="35" '
            . $this->error_class($id, 'action', 'subject', 'action_subject') .' />';
        $out .= '<br /><span class="label">' .rcube::Q($this->plugin->gettext('vacationaddr')) . '</span><br />'
            . $this->list_input($id, 'action_addresses', $action['addresses'], true,
                $this->error_class($id, 'action', 'addresses', 'action_addresses'), 30);
            . $this->list_input($id, 'action_addresses', $addresses, true,
                $this->error_class($id, 'action', 'addresses', 'action_addresses'), 30)
            . html::a(array('href' => '#', 'onclick' => rcmail_output::JS_OBJECT_NAME . ".managesieve_vacation_addresses($id)"),
                rcube::Q($this->plugin->gettext('filladdresses')));
        $out .= '<br /><span class="label">' . rcube::Q($this->plugin->gettext($vsec ? 'vacationinterval' : 'vacationdays')) . '</span><br />'
            .'<input type="text" name="_action_interval['.$id.']" id="action_interval'.$id.'" '
            .'value="' .rcube::Q(isset($action['seconds']) ? $action['seconds'] : $action['days'], 'strict', false) . '" size="2" '
            .'value="' .rcube::Q(rcube_sieve_vacation::vacation_interval($action), 'strict', false) . '" size="2" '
            . $this->error_class($id, 'action', 'interval', 'action_interval') .' />';
        if ($vsec) {
            $out .= '&nbsp;<label><input type="radio" name="_action_interval_type['.$id.']" value="days"'
@@ -2105,7 +2128,10 @@
                    foreach ($rules['actions'] as $action) {
                        if ($action['type'] == 'include' && empty($action['global'])) {
                            $name = preg_replace($filename_regex, '', $action['target']);
                            $this->active[] = $name;
                            // make sure the script exist
                            if (in_array($name, $this->list)) {
                                $this->active[] = $name;
                            }
                        }
                    }
                }
@@ -2341,11 +2367,11 @@
     */
    protected function init_script()
    {
        $this->script = $this->sieve->script->as_array();

        if (!$this->script) {
        if (!$this->sieve->script) {
            return;
        }

        $this->script = $this->sieve->script->as_array();

        $headers    = array();
        $exceptions = array('date', 'currentdate', 'size', 'body');
@@ -2375,4 +2401,21 @@

        $this->headers += $headers;
    }

    /**
     * Get all e-mail addresses of the user
     */
    protected function user_emails()
    {
        $addresses = $this->rc->user->list_emails();

        foreach ($addresses as $idx => $email) {
            $addresses[$idx] = $email['email'];
        }

        $addresses = array_unique($addresses);
        sort($addresses);

        return $addresses;
    }
}