Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

Aleksander Machniak

2013-10-17 037af6890fe6fdb84a08d3c86083e847c90ec0ad

 program/lib/Roundcube/rcube_message_header.php

@@ -2,8 +2,6 @@

/**
 +-----------------------------------------------------------------------+
 | program/include/rcube_message_header.php                              |
 |                                                                       |
 | This file is part of the Roundcube Webmail client                     |
 | Copyright (C) 2005-2012, The Roundcube Dev Team                       |
 | Copyright (C) 2011-2012, Kolab Systems AG                             |
@@ -14,7 +12,6 @@
 |                                                                       |
 | PURPOSE:                                                              |
 |   E-mail message headers representation                               |
 |                                                                       |
 +-----------------------------------------------------------------------+
 | Author: Aleksander Machniak <alec@alec.pl>                            |
 +-----------------------------------------------------------------------+
@@ -218,7 +215,12 @@
            $value = $this->others[$name];
        }

        return $decode ? rcube_mime::decode_header($value, $this->charset) : $value;
        if ($decode) {
            $value = rcube_mime::decode_header($value, $this->charset);
            $value = rcube_charset::clean($value);
        }

        return $value;
    }

    /**