Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

Aleksander Machniak

2013-10-17 037af6890fe6fdb84a08d3c86083e847c90ec0ad

 program/js/app.js

@@ -251,7 +251,8 @@
          }
        }
        else if (this.env.action == 'compose') {
          this.env.compose_commands = ['send-attachment', 'remove-attachment', 'send', 'cancel', 'toggle-editor', 'list-adresses', 'search', 'reset-search', 'extwin'];
          this.env.address_group_stack = [];
          this.env.compose_commands = ['send-attachment', 'remove-attachment', 'send', 'cancel', 'toggle-editor', 'list-adresses', 'pushgroup', 'search', 'reset-search', 'extwin'];

          if (this.env.drafts_mailbox)
            this.env.compose_commands.push('savedraft')
@@ -318,11 +319,13 @@
        break;

      case 'addressbook':
        this.env.address_group_stack = [];

        if (this.gui_objects.folderlist)
          this.env.contactfolders = $.extend($.extend({}, this.env.address_sources), this.env.contactgroups);

        this.enable_command('add', 'import', this.env.writable_source);
        this.enable_command('list', 'listgroup', 'listsearch', 'advanced-search', true);
        this.enable_command('list', 'listgroup', 'pushgroup', 'popgroup', 'listsearch', 'advanced-search', true);

        if (this.gui_objects.contactslist) {
          this.contact_list = new rcube_list_widget(this.gui_objects.contactslist,
@@ -769,7 +772,7 @@
      case 'moveto':
        if (this.task == 'mail')
          this.move_messages(props);
        else if (this.task == 'addressbook' && this.drag_active)
        else if (this.task == 'addressbook')
          this.copy_contact(null, props);
        break;

@@ -1080,9 +1083,23 @@
        }
        break;

      case 'pushgroup':
        // add group ID to stack
        this.env.address_group_stack.push(props.id);
        if (obj && event)
          rcube_event.cancel(event);

      case 'listgroup':
        this.reset_qsearch();
        this.list_contacts(props.source, props.id);
        break;

      case 'popgroup':
        if (this.env.address_group_stack.length > 1) {
          this.env.address_group_stack.pop();
          this.reset_qsearch();
          this.list_contacts(props.source, this.env.address_group_stack[this.env.address_group_stack.length-1]);
        }
        break;

      case 'import':
@@ -3066,7 +3083,13 @@

  this.compose_recipient_select = function(list)
  {
    this.enable_command('add-recipient', list.selection.length > 0);
    var id, n, recipients = 0;
    for (n=0; n < list.selection.length; n++) {
      id = list.selection[n];
      if (this.env.contactdata[id])
        recipients++;
    }
    this.enable_command('add-recipient', recipients);
  };

  this.compose_add_recipient = function(field)
@@ -4060,7 +4083,7 @@
    if (this.preview_timer)
      clearTimeout(this.preview_timer);

    var n, id, sid, ref = this, writable = false,
    var n, id, sid, contact, ref = this, writable = false,
      source = this.env.source ? this.env.address_sources[this.env.source] : null;

    // we don't have dblclick handler here, so use 200 instead of this.dblclick_time
@@ -4070,33 +4093,39 @@
      this.show_contentframe(false);

    if (list.selection.length) {
      list.draggable = false;

      // no source = search result, we'll need to detect if any of
      // selected contacts are in writable addressbook to enable edit/delete
      // we'll also need to know sources used in selection for copy
      // and group-addmember operations (drag&drop)
      this.env.selection_sources = [];
      if (!source) {
        for (n in list.selection) {

      if (source)
        this.env.selection_sources.push(this.env.source);

      for (n in list.selection) {
        contact = list.data[list.selection[n]];
        if (!source) {
          sid = String(list.selection[n]).replace(/^[^-]+-/, '');
          if (sid && this.env.address_sources[sid]) {
            writable = writable || !this.env.address_sources[sid].readonly;
            writable = writable || (!this.env.address_sources[sid].readonly && !contact.readonly);
            this.env.selection_sources.push(sid);
          }
        }
        this.env.selection_sources = $.unique(this.env.selection_sources);
        else
          writable = writable || (!source.readonly && !contact.readonly);
      }
      else {
        this.env.selection_sources.push(this.env.source);
        writable = !source.readonly;
      }

      this.env.selection_sources = $.unique(this.env.selection_sources);
    }

    // if a group is currently selected, and there is at least one contact selected
    // thend we can enable the group-remove-selected command
    this.enable_command('group-remove-selected', this.env.group && list.selection.length > 0);
    this.enable_command('group-remove-selected', this.env.group && list.selection.length > 0 && writable);
    this.enable_command('compose', this.env.group || list.selection.length > 0);
    this.enable_command('edit', id && writable);
    this.enable_command('delete', list.selection.length && writable);
    this.enable_command('delete', list.selection.length > 0 && writable);

    return false;
  };
@@ -4124,10 +4153,28 @@
    else if (!this.env.search_request)
      folder = group ? 'G'+src+group : src;

    this.select_folder(folder, '', true);

    this.env.source = src;
    this.env.group = group;

    // truncate groups listing stack
    var index = $.inArray(this.env.group, this.env.address_group_stack);
    if (index < 0)
      this.env.address_group_stack = [];
    else
      this.env.address_group_stack = this.env.address_group_stack.slice(0,index);

    // make sure the current group is on top of the stack
    if (this.env.group) {
      this.env.address_group_stack.push(this.env.group);

      // mark the first group on the stack as selected in the directory list
      folder = 'G'+src+this.env.address_group_stack[0];
    }
    else if (this.gui_objects.addresslist_title) {
      $(this.gui_objects.addresslist_title).html(this.get_label('contacts'));
    }

    this.select_folder(folder, '', true);

    // load contacts remotely
    if (this.gui_objects.contactslist) {
@@ -4183,16 +4230,38 @@

  this.list_contacts_clear = function()
  {
    this.contact_list.data = {};
    this.contact_list.clear(true);
    this.show_contentframe(false);
    this.enable_command('delete', false);
    this.enable_command('compose', this.env.group ? true : false);
  };

  this.set_group_prop = function(prop)
  {
    if (this.gui_objects.addresslist_title) {
      var boxtitle = $(this.gui_objects.addresslist_title).html('');  // clear contents

      // add link to pop back to parent group
      if (this.env.address_group_stack.length > 1) {
        $('<a href="#list">...</a>')
          .addClass('poplink')
          .appendTo(boxtitle)
          .click(function(e){ return ref.command('popgroup','',this); });
        boxtitle.append('&nbsp;&raquo;&nbsp;');
      }

      boxtitle.append($('<span>'+prop.name+'</span>'));
    }

    this.triggerEvent('groupupdate', prop);
  };

  // load contact record
  this.load_contact = function(cid, action, framed)
  {
    var win, url = {}, target = window;
    var win, url = {}, target = window,
      rec = this.contact_list ? this.contact_list.data[cid] : null;

    if (win = this.get_frame_window(this.env.contentframe)) {
      url._framed = 1;
@@ -4203,7 +4272,9 @@
      if (!cid) {
        // unselect selected row(s)
        this.contact_list.clear_selection();
        this.enable_command('delete', 'compose', false);

        this.enable_command('compose', rec && rec.email);
        this.enable_command('delete', rec && rec._type != 'group');
      }
    }
    else if (framed)
@@ -4314,7 +4385,7 @@
  };

  // update a contact record in the list
  this.update_contact_row = function(cid, cols_arr, newcid, source)
  this.update_contact_row = function(cid, cols_arr, newcid, source, data)
  {
    var c, row, list = this.contact_list;

@@ -4341,11 +4412,13 @@
        list.selection[0] = newcid;
        row.style.display = '';
      }

      list.data[cid] = data;
    }
  };

  // add row to contacts list
  this.add_contact_row = function(cid, cols, classes)
  this.add_contact_row = function(cid, cols, classes, data)
  {
    if (!this.gui_objects.contactslist)
      return false;
@@ -4368,6 +4441,8 @@
      row.appendChild(col);
    }

    // store data in list member
    list.data[cid] = data;
    list.insert_row(row);

    this.enable_command('export', list.rowcount > 0);
@@ -4777,6 +4852,9 @@
          if (++colprop.count == colprop.limit && colprop.limit)
            $(menu).children('option[value="'+col+'"]').prop('disabled', true);
        }

        if (contact._type != 'group')
          list.draggable = true;
      }
    }
  };