From 3e0e9148efdcee5ab39d9712169f4c01cfb4f48f Mon Sep 17 00:00:00 2001
From: thomascube <thomas@roundcube.net>
Date: Thu, 03 Feb 2011 16:12:35 -0500
Subject: [PATCH] Prevent from relaying arbitrary requests through modcss.inc (security issue)
---
program/steps/mail/func.inc | 7 ++++---
1 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc
index b1b5d91..fd00142 100644
--- a/program/steps/mail/func.inc
+++ b/program/steps/mail/func.inc
@@ -1194,15 +1194,16 @@
*/
function rcmail_alter_html_link($matches)
{
- global $EMAIL_ADDRESS_PATTERN;
+ global $RCMAIL, $EMAIL_ADDRESS_PATTERN;
$tag = $matches[1];
$attrib = parse_attrib_string($matches[2]);
$end = '>';
if ($tag == 'link' && preg_match('/^https?:\/\//i', $attrib['href'])) {
- $attrib['href'] = "?_task=utils&_action=modcss&u=" . urlencode($attrib['href'])
- . "&c=" . urlencode($GLOBALS['rcmail_html_container_id']);
+ $tempurl = 'tmp-' . md5($attrib['href']) . '.css';
+ $_SESSION['modcssurls'][$tempurl] = $attrib['href'];
+ $attrib['href'] = $RCMAIL->url(array('task' => 'utils', 'action' => 'modcss', 'u' => $tempurl, 'c' => $GLOBALS['rcmail_html_container_id']));
$end = ' />';
}
else if (preg_match('/^mailto:'.$EMAIL_ADDRESS_PATTERN.'(\?[^"\'>]+)?/i', $attrib['href'], $mailto)) {
--
Gitblit v1.9.1