Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

Aleksander Machniak

2013-10-17 037af6890fe6fdb84a08d3c86083e847c90ec0ad

 program/js/list.js

@@ -110,7 +110,7 @@
    row.onmousedown = function(e){ return self.drag_row(e, this.uid); };
    row.onmouseup = function(e){ return self.click_row(e, this.uid); };

    if (bw.mobile) {
    if (bw.touch) {
      row.addEventListener('touchstart', function(e) {
        if (e.touches.length == 1) {
          self.touchmoved = false;
@@ -307,7 +307,7 @@
  if (rcube_event.get_button(e) == 2)
    return true;

  this.in_selection_before = e.istouch || this.in_selection(id) ? id : false;
  this.in_selection_before = e && e.istouch || this.in_selection(id) ? id : false;

  // selects currently unselected row
  if (!this.in_selection_before) {
@@ -320,7 +320,7 @@
    this.drag_mouse_start = rcube_event.get_mouse_pos(e);
    rcube_event.add_listener({event:'mousemove', object:this, method:'drag_mouse_move'});
    rcube_event.add_listener({event:'mouseup', object:this, method:'drag_mouse_up'});
    if (bw.mobile) {
    if (bw.touch) {
      rcube_event.add_listener({event:'touchmove', object:this, method:'drag_mouse_move'});
      rcube_event.add_listener({event:'touchend', object:this, method:'drag_mouse_up'});
    }
@@ -1239,7 +1239,7 @@
  rcube_event.remove_listener({event:'mousemove', object:this, method:'drag_mouse_move'});
  rcube_event.remove_listener({event:'mouseup', object:this, method:'drag_mouse_up'});

  if (bw.mobile) {
  if (bw.touch) {
    rcube_event.remove_listener({event:'touchmove', object:this, method:'drag_mouse_move'});
    rcube_event.remove_listener({event:'touchend', object:this, method:'drag_mouse_up'});
  }