Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

Aleksander Machniak

2013-10-17 037af6890fe6fdb84a08d3c86083e847c90ec0ad

 program/include/rcmail_output_html.php

@@ -1176,7 +1176,7 @@

        // generate html code for button
        if ($btn_content) {
            $attrib_str = html::attrib_string($attrib, array_merge(html::$common_attrib, $link_attrib));
            $attrib_str = html::attrib_string($attrib, $link_attrib);
            $out = sprintf('<a%s>%s</a>', $attrib_str, $btn_content);
        }