Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

Aleksander Machniak

2013-10-17 197203727417a03d87053a47e5aa5175a76e3e0b

 program/steps/mail/list.inc

@@ -5,7 +5,7 @@
 | program/steps/mail/list.inc                                           |
 |                                                                       |
 | This file is part of the Roundcube Webmail client                     |
 | Copyright (C) 2005-2007, Roundcube Dev. - Switzerland                 |
 | Copyright (C) 2005-2007, The Roundcube Dev Team                       |
 | Licensed under the GNU GPL                                            |
 |                                                                       |
 | PURPOSE:                                                              |
@@ -34,12 +34,6 @@
  $_SESSION['sort_col'] = $save_arr['message_sort_col'] = $sort_col;
  $_SESSION['sort_order'] = $save_arr['message_sort_order'] = $sort_order;
}
else
{
  // use session settings if set, defaults if not
  $sort_col   = isset($_SESSION['sort_col'])   ? $_SESSION['sort_col']   : $CONFIG['message_sort_col'];
  $sort_order = isset($_SESSION['sort_order']) ? $_SESSION['sort_order'] : $CONFIG['message_sort_order'];
}

// is there a set of columns for this request?
if ($cols = get_input_value('_cols', RCUBE_INPUT_GET))
@@ -53,22 +47,34 @@

$mbox_name = $IMAP->get_mailbox_name();

// Synchronize mailbox cache, handle flag changes
$IMAP->mailbox_sync($mbox_name);

// initialize searching result if search_filter is used
if ($_SESSION['search_filter'] && $_SESSION['search_filter'] != 'ALL')
{
  $search_request = md5($mbox_name.$_SESSION['search_filter']);
  $IMAP->search($mbox_name, $_SESSION['search_filter'], RCMAIL_CHARSET, $sort_col);
  $_SESSION['search'][$search_request] = $IMAP->get_search_set();
  $IMAP->search($mbox_name, $_SESSION['search_filter'], RCMAIL_CHARSET, rcmail_sort_column());
  $_SESSION['search'] = $IMAP->get_search_set();
  $_SESSION['search_request'] = $search_request;
  $OUTPUT->set_env('search_request', $search_request);
}

// fetch message headers
if ($count = $IMAP->messagecount($mbox_name, $IMAP->threading ? 'THREADS' : 'ALL', !empty($_REQUEST['_refresh'])))
  $a_headers = $IMAP->list_headers($mbox_name, NULL, $sort_col, $sort_order);
  $a_headers = $IMAP->list_headers($mbox_name, NULL, rcmail_sort_column(), rcmail_sort_order());

// update search set (possible change of threading mode)
if (!empty($_REQUEST['_search']) && isset($_SESSION['search'][$_REQUEST['_search']]))
  $_SESSION['search'][$_REQUEST['_search']] = $IMAP->get_search_set();
if (!empty($_REQUEST['_search']) && isset($_SESSION['search'])
    && $_SESSION['search_request'] == $_REQUEST['_search']
) {
  $_SESSION['search'] = $IMAP->get_search_set();
}
// remove old search data
else if (empty($_REQUEST['_search']) && isset($_SESSION['search'])) {
  $RCMAIL->session->remove('search');
}


// empty result? we'll skip UNSEEN counting in rcmail_send_unread_count()
if (empty($search_request) && empty($a_headers)) {
@@ -84,7 +90,7 @@
$OUTPUT->set_env('pagecount', $pages);
$OUTPUT->set_env('threading', (bool) $IMAP->threading);
$OUTPUT->set_env('current_page', $count ? $IMAP->list_page : 1);
$OUTPUT->command('set_rowcount', rcmail_get_messagecount_text($count));
$OUTPUT->command('set_rowcount', rcmail_get_messagecount_text($count), $mbox_name);
$OUTPUT->command('set_mailboxname', rcmail_get_mailbox_name_text());

// add message rows
@@ -94,12 +100,16 @@
  if ($search_request)
    $OUTPUT->show_message('searchsuccessful', 'confirmation', array('nr' => $count));
}
else if ($search_request)
  $OUTPUT->show_message('searchnomatch', 'notice');
else
  $OUTPUT->show_message('nomessagesfound', 'notice');
else {
  // handle IMAP errors (e.g. #1486905)
  if ($err_code = $IMAP->get_error_code()) {
    rcmail_display_server_error();
  }
  else if ($search_request)
    $OUTPUT->show_message('searchnomatch', 'notice');
  else
    $OUTPUT->show_message('nomessagesfound', 'notice');
}

// send response
$OUTPUT->send();