From 6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Thu, 07 May 2015 03:02:29 -0400
Subject: [PATCH] Fix security issue in contact photo handling (#1490379)
---
program/steps/mail/show.inc | 6 ++----
1 files changed, 2 insertions(+), 4 deletions(-)
diff --git a/program/steps/mail/show.inc b/program/steps/mail/show.inc
index afaa0da..5d9aff4 100644
--- a/program/steps/mail/show.inc
+++ b/program/steps/mail/show.inc
@@ -270,14 +270,13 @@
function rcmail_message_buttons()
{
- global $RCMAIL;
+ global $RCMAIL, $MESSAGE;
- $mbox = $RCMAIL->storage->get_folder();
$delim = $RCMAIL->storage->get_hierarchy_delimiter();
$dbox = $RCMAIL->config->get('drafts_mbox');
// the message is not a draft
- if ($mbox != $dbox && strpos($mbox, $dbox.$delim) !== 0) {
+ if ($MESSAGE->folder != $dbox && strpos($MESSAGE->folder, $dbox.$delim) !== 0) {
return '';
}
@@ -344,7 +343,6 @@
'_task' => 'addressbook',
'_action' => 'photo',
'_email' => $MESSAGE->sender['mailto'],
- '_alt' => $placeholder,
));
$attrib['onerror'] = "this.src = '" . ($placeholder ? $placeholder : 'program/resources/blank.gif') . "'";
--
Gitblit v1.9.1