Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

Aleksander Machniak

2013-10-17 037af6890fe6fdb84a08d3c86083e847c90ec0ad

 program/lib/Roundcube/rcube_config.php

@@ -2,8 +2,6 @@

/*
 +-----------------------------------------------------------------------+
 | program/include/rcube_config.php                                      |
 |                                                                       |
 | This file is part of the Roundcube Webmail client                     |
 | Copyright (C) 2008-2012, The Roundcube Dev Team                       |
 |                                                                       |
@@ -13,7 +11,6 @@
 |                                                                       |
 | PURPOSE:                                                              |
 |   Class to read configuration settings                                |
 |                                                                       |
 +-----------------------------------------------------------------------+
 | Author: Thomas Bruederli <roundcube@gmail.com>                        |
 +-----------------------------------------------------------------------+
@@ -71,11 +68,11 @@
    private function load()
    {
        // load main config file
        if (!$this->load_from_file(RCUBE_CONFIG_DIR . '/main.inc.php'))
        if (!$this->load_from_file(RCUBE_CONFIG_DIR . 'main.inc.php'))
            $this->errors[] = 'main.inc.php was not found.';

        // load database config
        if (!$this->load_from_file(RCUBE_CONFIG_DIR . '/db.inc.php'))
        if (!$this->load_from_file(RCUBE_CONFIG_DIR . 'db.inc.php'))
            $this->errors[] = 'db.inc.php was not found.';

        // load host-specific configuration
@@ -101,11 +98,11 @@

        // fix default imap folders encoding
        foreach (array('drafts_mbox', 'junk_mbox', 'sent_mbox', 'trash_mbox') as $folder)
            $this->prop[$folder] = rcube_charset::convert($this->prop[$folder], RCMAIL_CHARSET, 'UTF7-IMAP');
            $this->prop[$folder] = rcube_charset::convert($this->prop[$folder], RCUBE_CHARSET, 'UTF7-IMAP');

        if (!empty($this->prop['default_folders']))
            foreach ($this->prop['default_folders'] as $n => $folder)
                $this->prop['default_folders'][$n] = rcube_charset::convert($folder, RCMAIL_CHARSET, 'UTF7-IMAP');
                $this->prop['default_folders'][$n] = rcube_charset::convert($folder, RCUBE_CHARSET, 'UTF7-IMAP');

        // set PHP error logging according to config
        if ($this->prop['debug_level'] & 1) {
@@ -156,7 +153,7 @@
        }

        if ($fname) {
            $this->load_from_file(RCUBE_CONFIG_DIR . '/' . $fname);
            $this->load_from_file(RCUBE_CONFIG_DIR . $fname);
        }
    }

@@ -177,7 +174,7 @@
            ob_end_clean();

            if (is_array($rcmail_config)) {
                $this->prop = array_merge($this->prop, $rcmail_config, $this->userprefs);
                $this->merge($rcmail_config);
                return true;
            }
        }
@@ -195,11 +192,8 @@
     */
    public function get($name, $def = null)
    {
        if (isset($this->prop[$name])) {
        if (array_key_exists($name, $this->prop)) {
            $result = $this->prop[$name];
        }
        else if (isset($this->legacy_props[$name])) {
            return $this->get($this->legacy_props[$name], $def);
        }
        else {
            $result = $def;
@@ -243,6 +237,7 @@
     */
    public function merge($prefs)
    {
        $prefs = $this->fix_legacy_props($prefs);
        $this->prop = array_merge($this->prop, $prefs, $this->userprefs);
    }

@@ -255,6 +250,8 @@
     */
    public function set_user_prefs($prefs)
    {
        $prefs = $this->fix_legacy_props($prefs);

        // Honor the dont_override setting for any existing user preferences
        $dont_override = $this->get('dont_override');
        if (is_array($dont_override) && !empty($dont_override)) {
@@ -288,7 +285,7 @@
    /**
     * Getter for all config options
     *
     * @return array  Hash array containg all config properties
     * @return array  Hash array containing all config properties
     */
    public function all()
    {
@@ -438,4 +435,24 @@
        return date_default_timezone_get();
    }

    /**
     * Convert legacy options into new ones
     *
     * @param array $props Hash array with config props
     *
     * @return array Converted config props
     */
    private function fix_legacy_props($props)
    {
        foreach ($this->legacy_props as $new => $old) {
            if (isset($props[$old])) {
                if (!isset($props[$new])) {
                    $props[$new] = $props[$old];
                }
                unset($props[$old]);
            }
        }

        return $props;
    }
}