Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

Aleksander Machniak

2013-10-17 197203727417a03d87053a47e5aa5175a76e3e0b

 program/steps/mail/compose.inc

@@ -243,7 +243,8 @@
if (count($MESSAGE->identities))
{
  foreach ($MESSAGE->identities as $idx => $ident) {
    $email = mb_strtolower(rcube_idn_to_utf8($ident['email']));
    $ident['email'] = format_email($ident['email']);
    $email = format_email(rcube_idn_to_utf8($ident['email']));

    $MESSAGE->identities[$idx]['email_ascii'] = $ident['email'];
    $MESSAGE->identities[$idx]['ident']       = format_email_recipient($ident['email'], $ident['name']);
@@ -268,7 +269,7 @@
    $a_to = $IMAP->decode_address_list($MESSAGE->headers->to);
    foreach ($a_to as $addr) {
      if (!empty($addr['mailto'])) {
        $a_recipients[] = strtolower($addr['mailto']);
        $a_recipients[] = format_email($addr['mailto']);
        $a_names[]      = $addr['name'];
      }
    }
@@ -277,7 +278,7 @@
      $a_cc = $IMAP->decode_address_list($MESSAGE->headers->cc);
      foreach ($a_cc as $addr) {
        if (!empty($addr['mailto'])) {
          $a_recipients[] = strtolower($addr['mailto']);
          $a_recipients[] = format_email($addr['mailto']);
          $a_names[]      = $addr['name'];
        }
      }
@@ -424,7 +425,7 @@
      if (empty($addr_part['mailto']))
        continue;

      $mailto = mb_strtolower(rcube_idn_to_utf8($addr_part['mailto']));
      $mailto = format_email(rcube_idn_to_utf8($addr_part['mailto']));

      if (!in_array($mailto, $a_recipients)
        && ($header == 'to' || empty($MESSAGE->compose['from_email']) || $mailto != $MESSAGE->compose['from_email'])
@@ -715,7 +716,7 @@
  if ($isHtml) {
    $attrib['class'] = 'mce_editor';
    $textarea = new html_textarea($attrib);
    $out .= $textarea->show($MESSAGE_BODY);
    $out .= $textarea->show(htmlentities($MESSAGE_BODY, ENT_NOQUOTES, RCMAIL_CHARSET));
  }
  else {
    $textarea = new html_textarea($attrib);
@@ -900,18 +901,18 @@
        "<tr><th align=\"right\" nowrap=\"nowrap\" valign=\"baseline\">%s: </th><td>%s</td></tr>",
      rcube_label('subject'), Q($MESSAGE->subject),
      rcube_label('date'), Q($date),
      rcube_label('from'), htmlspecialchars(Q($MESSAGE->get_header('from'), 'replace'), ENT_COMPAT, $charset),
      rcube_label('to'), htmlspecialchars(Q($MESSAGE->get_header('to'), 'replace'), ENT_COMPAT, $charset));
      rcube_label('from'), Q($MESSAGE->get_header('from'), 'replace'),
      rcube_label('to'), Q($MESSAGE->get_header('to'), 'replace'));

    if ($MESSAGE->headers->cc)
      $prefix .= sprintf("<tr><th align=\"right\" nowrap=\"nowrap\" valign=\"baseline\">%s: </th><td>%s</td></tr>",
        rcube_label('cc'),
        htmlspecialchars(Q($MESSAGE->get_header('cc'), 'replace'), ENT_COMPAT, $charset));
        Q($MESSAGE->get_header('cc'), 'replace'));

    if ($MESSAGE->headers->replyto && $MESSAGE->headers->replyto != $MESSAGE->headers->from)
      $prefix .= sprintf("<tr><th align=\"right\" nowrap=\"nowrap\" valign=\"baseline\">%s: </th><td>%s</td></tr>",
        rcube_label('replyto'),
        htmlspecialchars(Q($MESSAGE->get_header('replyto'), 'replace'), ENT_COMPAT, $charset));
        Q($MESSAGE->get_header('replyto'), 'replace'));

    $prefix .= "</tbody></table><br>";
  }