Fix XSS issue in href attribute on area tag (#5240, #5241)

Aleksander Machniak

2016-05-06 acf633c73bc8df9a5036bc52d7568f4213ab73c7

 plugins/additional_message_headers/additional_message_headers.php

@@ -7,7 +7,7 @@
 * to or remove them from outgoing messages.
 *
 * Enable the plugin in config.inc.php and add your desired headers:
 * $rcmail_config['additional_message_headers'] = array('User-Agent');
 * $config['additional_message_headers'] = array('User-Agent' => 'My-Very-Own-Webmail');
 *
 * @version @package_version@
 * @author Ziba Scott
@@ -15,24 +15,39 @@
 */
class additional_message_headers extends rcube_plugin
{
    public $task = 'mail';

    function init()
    {
        $this->add_hook('message_outgoing_headers', array($this, 'message_headers'));
        $this->add_hook('message_before_send', array($this, 'message_headers'));
    }

    function message_headers($args)
    {
       $this->load_config();
        $this->load_config();

        $rcube = rcube::get_instance();

        // additional email headers
        $additional_headers = rcmail::get_instance()->config->get('additional_message_headers',array());
        foreach($additional_headers as $header=>$value){
            if (null === $value) {
                unset($args['headers'][$header]);
            } else {
                $args['headers'][$header] = $value;
        $additional_headers = $rcube->config->get('additional_message_headers', array());

        if (!empty($additional_headers)) {
            // Mail_mime >= 1.9.0
            if (method_exists($message, 'isMultipart')) {
                $args['message']->headers($additional_headers, true);
            }
            else {
                $headers = $args['message']->headers();

                foreach ((array) $additional_headers as $header => $value) {
                    if ($value === null) {
                        unset($headers[$header]);
                    }
                    else {
                        $headers[$header] = $value;
                    }
                }

                $args['message']->_headers = array();
                $args['message']->headers($headers);
            }
        }