From 6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Thu, 07 May 2015 03:02:29 -0400
Subject: [PATCH] Fix security issue in contact photo handling (#1490379)
---
program/steps/mail/show.inc | 10 +++++-----
1 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/program/steps/mail/show.inc b/program/steps/mail/show.inc
index 1616eb6..5d9aff4 100644
--- a/program/steps/mail/show.inc
+++ b/program/steps/mail/show.inc
@@ -80,7 +80,7 @@
// set configuration
$RCMAIL->set_env_config(array('delete_junk', 'flag_for_deletion', 'read_when_deleted',
- 'skip_deleted', 'display_next', 'compose_extwin', 'forward_attachment'));
+ 'skip_deleted', 'display_next', 'forward_attachment'));
// set special folders
foreach (array('drafts', 'trash', 'junk') as $mbox) {
@@ -270,14 +270,13 @@
function rcmail_message_buttons()
{
- global $RCMAIL;
+ global $RCMAIL, $MESSAGE;
- $mbox = $RCMAIL->storage->get_folder();
$delim = $RCMAIL->storage->get_hierarchy_delimiter();
$dbox = $RCMAIL->config->get('drafts_mbox');
// the message is not a draft
- if ($mbox != $dbox && strpos($mbox, $dbox.$delim) !== 0) {
+ if ($MESSAGE->folder != $dbox && strpos($MESSAGE->folder, $dbox.$delim) !== 0) {
return '';
}
@@ -344,8 +343,9 @@
'_task' => 'addressbook',
'_action' => 'photo',
'_email' => $MESSAGE->sender['mailto'],
- '_alt' => $placeholder
));
+
+ $attrib['onerror'] = "this.src = '" . ($placeholder ? $placeholder : 'program/resources/blank.gif') . "'";
}
else {
$photo_img = $placeholder ? $placeholder : 'program/resources/blank.gif';
--
Gitblit v1.9.1