Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

Aleksander Machniak

2013-10-17 037af6890fe6fdb84a08d3c86083e847c90ec0ad

 program/lib/Roundcube/rcube_message_header.php

@@ -2,8 +2,6 @@

/**
 +-----------------------------------------------------------------------+
 | program/include/rcube_message_header.php                              |
 |                                                                       |
 | This file is part of the Roundcube Webmail client                     |
 | Copyright (C) 2005-2012, The Roundcube Dev Team                       |
 | Copyright (C) 2011-2012, Kolab Systems AG                             |
@@ -14,7 +12,6 @@
 |                                                                       |
 | PURPOSE:                                                              |
 |   E-mail message headers representation                               |
 |                                                                       |
 +-----------------------------------------------------------------------+
 | Author: Aleksander Machniak <alec@alec.pl>                            |
 +-----------------------------------------------------------------------+
@@ -195,6 +192,7 @@
        'content-transfer-encoding' => 'encoding',
        'in-reply-to'               => 'in_reply_to',
        'content-type'              => 'ctype',
        'charset'                   => 'charset',
        'references'                => 'references',
        'return-receipt-to'         => 'mdn_to',
        'disposition-notification-to' => 'mdn_to',
@@ -217,7 +215,12 @@
            $value = $this->others[$name];
        }

        return $decode ? rcube_mime::decode_header($value, $this->charset) : $value;
        if ($decode) {
            $value = rcube_mime::decode_header($value, $this->charset);
            $value = rcube_charset::clean($value);
        }

        return $value;
    }

    /**
@@ -234,13 +237,30 @@
            $this->others[$name] = $value;
        }
    }


    /**
     * Factory method to instantiate headers from a data array
     *
     * @param array Hash array with header values
     * @return object rcube_message_header instance filled with headers values
     */
    public static function from_array($arr)
    {
        $obj = new rcube_message_header;
        foreach ($arr as $k => $v)
            $obj->set($k, $v);

        return $obj;
    }
}


/**
 * Class for sorting an array of rcube_message_header objects in a predetermined order.
 *
 * @package Mail
 * @package    Framework
 * @subpackage Storage
 * @author  Aleksander Machniak <alec@alec.pl>
 */
class rcube_message_header_sorter