Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

Aleksander Machniak

2013-10-17 197203727417a03d87053a47e5aa5175a76e3e0b

 program/include/rcube_cache.php

@@ -245,26 +245,30 @@
            return null;
        }

        if ($this->type == 'memcache') {
            $data = $this->db->get($this->ckey($key));
        }
        else if ($this->type == 'apc') {
            $data = apc_fetch($this->ckey($key));
       }

        if ($data) {
            $md5sum = md5($data);
            $data   = $this->packed ? unserialize($data) : $data;

            if ($nostore) {
                return $data;
        if ($this->type != 'db') {
            if ($this->type == 'memcache') {
                $data = $this->db->get($this->ckey($key));
            }
            else if ($this->type == 'apc') {
                $data = apc_fetch($this->ckey($key));
           }

            $this->cache_sums[$key] = $md5sum;
            $this->cache[$key]      = $data;
            if ($data) {
                $md5sum = md5($data);
                $data   = $this->packed ? unserialize($data) : $data;

                if ($nostore) {
                    return $data;
                }

                $this->cache_sums[$key] = $md5sum;
                $this->cache[$key]      = $data;
            }
            else {
                $this->cache[$key] = null;
            }
        }

        if ($this->type == 'db') {
        else {
            $sql_result = $this->db->limitquery(
                "SELECT cache_id, data, cache_key".
                " FROM ".get_table_name('cache').
@@ -289,6 +293,9 @@
                $this->cache[$key]      = $data;
               $this->cache_sums[$key] = $md5sum;
                $this->cache_keys[$key] = $sql_arr['cache_id'];
            }
            else {
                $this->cache[$key] = null;
            }
        }

@@ -454,10 +461,13 @@
     */
    private function delete_record($key, $index=true)
    {
        if ($this->type == 'memcache')
            $this->db->delete($this->ckey($key));
        else
        if ($this->type == 'memcache') {
            // #1488592: use 2nd argument
            $this->db->delete($this->ckey($key), 0);
        }
        else {
            apc_delete($this->ckey($key));
        }

        if ($index) {
            if (($idx = array_search($key, $this->index)) !== false) {