Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

Aleksander Machniak

2013-10-17 037af6890fe6fdb84a08d3c86083e847c90ec0ad

 program/lib/Roundcube/rcube_base_replacer.php

@@ -2,8 +2,6 @@

/*
 +-----------------------------------------------------------------------+
 | program/include/rcube_base_replacer.php                               |
 |                                                                       |
 | This file is part of the Roundcube Webmail client                     |
 | Copyright (C) 2005-2012, The Roundcube Dev Team                       |
 |                                                                       |
@@ -13,7 +11,6 @@
 |                                                                       |
 | PURPOSE:                                                              |
 |   Provide basic functions for base URL replacement                    |
 |                                                                       |
 +-----------------------------------------------------------------------+
 | Author: Thomas Bruederli <roundcube@gmail.com>                        |
 +-----------------------------------------------------------------------+
@@ -47,8 +44,8 @@
    public function replace($body)
    {
        return preg_replace_callback(array(
            '/(src|background|href)=(["\']?)([^"\'\s]+)(\2|\s|>)/Ui',
            '/(url\s*\()(["\']?)([^"\'\)\s]+)(\2)\)/Ui',
            '/(src|background|href)=(["\']?)([^"\'\s>]+)(\2|\s|>)/i',
            '/(url\s*\()(["\']?)([^"\'\)\s]+)(\2)\)/i',
        ),
        array($this, 'callback'), $body);
    }