From eb433aa33cec00b42eba3153fc905ebef9c6fd0b Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Thu, 17 Oct 2013 04:21:29 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
program/include/rcube_plugin_api.php | 46 +++++++++++++++++++++++++++++++++++++++++-----
1 files changed, 41 insertions(+), 5 deletions(-)
diff --git a/program/include/rcube_plugin_api.php b/program/include/rcube_plugin_api.php
index 0e38a31..a1e634a 100644
--- a/program/include/rcube_plugin_api.php
+++ b/program/include/rcube_plugin_api.php
@@ -5,8 +5,11 @@
| program/include/rcube_plugin_api.php |
| |
| This file is part of the Roundcube Webmail client |
- | Copyright (C) 2008-2009, The Roundcube Dev Team |
- | Licensed under the GNU GPL |
+ | Copyright (C) 2008-2011, The Roundcube Dev Team |
+ | |
+ | Licensed under the GNU General Public License version 3 or |
+ | any later version with exceptions for skins & plugins. |
+ | See the README file for a full license statement. |
| |
| PURPOSE: |
| Plugins repository |
@@ -27,12 +30,14 @@
class rcube_plugin_api
{
static private $instance;
-
+
public $dir;
public $url = 'plugins/';
public $output;
public $config;
-
+ public $allowed_prefs = array();
+ public $allowed_session_prefs = array();
+
public $handlers = array();
private $plugins = array();
private $tasks = array();
@@ -40,7 +45,7 @@
private $actionmap = array();
private $objectsmap = array();
private $template_contents = array();
- private $required_plugins = array('filesystem_attachments');
+ private $required_plugins = array('filesystem_attachments', 'jqueryui');
private $active_hook = false;
// Deprecated names of hooks, will be removed after 0.5-stable release
@@ -71,6 +76,9 @@
'delete_identity' => 'identity_delete',
'save_identity' => 'identity_update',
'identity_save' => 'identity_update',
+ // to be removed after 0.8
+ 'imap_init' => 'storage_init',
+ 'mailboxes_list' => 'storage_folders',
);
/**
@@ -182,6 +190,9 @@
$plugin->init();
$this->plugins[$plugin_name] = $plugin;
}
+ if (!empty($plugin->allowed_prefs)) {
+ $this->allowed_prefs = array_merge($this->allowed_prefs, $plugin->allowed_prefs);
+ }
return true;
}
}
@@ -222,6 +233,20 @@
raise_error(array('code' => 521, 'type' => 'php',
'file' => __FILE__, 'line' => __LINE__,
'message' => "Invalid callback function for $hook"), true, false);
+ }
+
+ /**
+ * Allow a plugin object to unregister a callback.
+ *
+ * @param string $hook Hook name
+ * @param mixed $callback String with global function name or array($obj, 'methodname')
+ */
+ public function unregister_hook($hook, $callback)
+ {
+ $callback_id = array_search($callback, $this->handlers[$hook]);
+ if ($callback_id !== false) {
+ unset($this->handlers[$hook][$callback_id]);
+ }
}
@@ -422,6 +447,17 @@
/**
+ * Returns list of loaded plugins names
+ *
+ * @return array List of plugin names
+ */
+ public function loaded_plugins()
+ {
+ return array_keys($this->plugins);
+ }
+
+
+ /**
* Callback for template_container hooks
*
* @param array $attrib
--
Gitblit v1.9.1