From 197203727417a03d87053a47e5aa5175a76e3e0b Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Thu, 17 Oct 2013 04:24:53 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
program/include/rcube_imap.php | 29 ++++++++++++++++++++---------
1 files changed, 20 insertions(+), 9 deletions(-)
diff --git a/program/include/rcube_imap.php b/program/include/rcube_imap.php
index 514d11b..f06a8ee 100644
--- a/program/include/rcube_imap.php
+++ b/program/include/rcube_imap.php
@@ -687,8 +687,8 @@
{
$mode = strtoupper($mode);
- // count search set
- if ($this->search_string && $mailbox == $this->mailbox && ($mode == 'ALL' || $mode == 'THREADS') && !$force) {
+ // count search set, assume search set is always up-to-date (don't check $force flag)
+ if ($this->search_string && $mailbox == $this->mailbox && ($mode == 'ALL' || $mode == 'THREADS')) {
if ($this->search_threads)
return $mode == 'ALL' ? count((array)$this->search_set['depth']) : count((array)$this->search_set['tree']);
else
@@ -3040,9 +3040,10 @@
NULL, array('SUBSCRIBED'));
// unsubscribe non-existent folders, remove from the list
- if (is_array($a_folders) && $name == '*') {
+ // we can do this only when LIST response is available
+ if (is_array($a_folders) && $name == '*' && !empty($this->conn->data['LIST'])) {
foreach ($a_folders as $idx => $folder) {
- if ($this->conn->data['LIST'] && ($opts = $this->conn->data['LIST'][$folder])
+ if (($opts = $this->conn->data['LIST'][$folder])
&& in_array('\\NonExistent', $opts)
) {
$this->conn->unsubscribe($folder);
@@ -3055,11 +3056,12 @@
else {
$a_folders = $this->conn->listSubscribed($root, $name);
- // unsubscribe non-existent folders, remove from the list
- if (is_array($a_folders) && $name == '*') {
+ // unsubscribe non-existent folders, remove them from the list,
+ // we can do this only when LIST response is available
+ if (is_array($a_folders) && $name == '*' && !empty($this->conn->data['LIST'])) {
foreach ($a_folders as $idx => $folder) {
- if ($this->conn->data['LIST'] && ($opts = $this->conn->data['LIST'][$folder])
- && in_array('\\Noselect', $opts)
+ if (!isset($this->conn->data['LIST'][$folder])
+ || in_array('\\Noselect', $this->conn->data['LIST'][$folder])
) {
// Some servers returns \Noselect for existing folders
if (!$this->mailbox_exists($folder)) {
@@ -3651,7 +3653,7 @@
$options['rights'] = $acl && !$options['is_root'] ? (array)$this->my_rights($mailbox) : array();
$options['special'] = in_array($mailbox, $this->default_folders);
- // Set 'noselect' and 'norename' flags
+ // Set 'noselect' flag
if (is_array($options['attributes'])) {
foreach ($options['attributes'] as $attrib) {
$attrib = strtolower($attrib);
@@ -3664,6 +3666,15 @@
$options['noselect'] = true;
}
+ // Get folder rights (MYRIGHTS)
+ if ($acl && !$options['noselect']) {
+ // skip shared roots
+ if (!$options['is_root'] || $options['namespace'] == 'personal') {
+ $options['rights'] = (array)$this->my_rights($mailbox);
+ }
+ }
+
+ // Set 'norename' flag
if (!empty($options['rights'])) {
$options['norename'] = !in_array('x', $options['rights']) && !in_array('d', $options['rights']);
--
Gitblit v1.9.1