From 197203727417a03d87053a47e5aa5175a76e3e0b Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Thu, 17 Oct 2013 04:24:53 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
program/lib/Mail/mimePart.php | 23 ++++++++++++++++-------
1 files changed, 16 insertions(+), 7 deletions(-)
diff --git a/program/lib/Mail/mimePart.php b/program/lib/Mail/mimePart.php
index 60b3601..a1cf111 100644
--- a/program/lib/Mail/mimePart.php
+++ b/program/lib/Mail/mimePart.php
@@ -131,6 +131,7 @@
*/
var $_eol = "\r\n";
+
/**
* Constructor.
*
@@ -144,7 +145,7 @@
* charset - Content character set
* cid - Content ID to apply
* disposition - Content disposition, inline or attachment
- * dfilename - Filename parameter for content disposition
+ * filename - Filename parameter for content disposition
* description - Content description
* name_encoding - Encoding of the attachment name (Content-Type)
* By default filenames are encoded using RFC2231
@@ -184,6 +185,11 @@
case 'body_file':
$this->_body_file = $value;
+ break;
+
+ // for backward compatibility
+ case 'dfilename':
+ $params['filename'] = $value;
break;
}
}
@@ -633,8 +639,8 @@
// RFC 2045:
// value needs encoding if contains non-ASCII chars or is longer than 78 chars
if (!preg_match('#[^\x20-\x7E]#', $value)) {
- $token_regexp = '#([^\x21,\x23-\x27,\x2A,\x2B,\x2D'
- . ',\x2E,\x30-\x39,\x41-\x5A,\x5E-\x7E])#';
+ $token_regexp = '#([^\x21\x23-\x27\x2A\x2B\x2D'
+ . '\x2E\x30-\x39\x41-\x5A\x5E-\x7E])#';
if (!preg_match($token_regexp, $value)) {
// token
if (strlen($name) + strlen($value) + 3 <= $maxLength) {
@@ -656,7 +662,7 @@
// RFC2231:
$encValue = preg_replace_callback(
- '/([^\x21,\x23,\x24,\x26,\x2B,\x2D,\x2E,\x30-\x39,\x41-\x5A,\x5E-\x7E])/',
+ '/([^\x21\x23\x24\x26\x2B\x2D\x2E\x30-\x39\x41-\x5A\x5E-\x7E])/',
array($this, '_encodeReplaceCallback'), $value
);
$value = "$charset'$language'$encValue";
@@ -800,6 +806,9 @@
// Structured header (make sure addr-spec inside is not encoded)
if (!empty($separator)) {
+ // Simple e-mail address regexp
+ $email_regexp = '(\S+|("[^\r\n"]+"))@\S+';
+
$parts = Mail_mimePart::_explodeQuotedString($separator, $value);
$value = '';
@@ -817,12 +826,12 @@
}
// let's find phrase (name) and/or addr-spec
- if (preg_match('/^<\S+@\S+>$/', $part)) {
+ if (preg_match('/^<' . $email_regexp . '>$/', $part)) {
$value .= $part;
- } else if (preg_match('/^\S+@\S+$/', $part)) {
+ } else if (preg_match('/^' . $email_regexp . '$/', $part)) {
// address without brackets and without name
$value .= $part;
- } else if (preg_match('/<*\S+@\S+>*$/', $part, $matches)) {
+ } else if (preg_match('/<*' . $email_regexp . '>*$/', $part, $matches)) {
// address with name (handle name)
$address = $matches[0];
$word = str_replace($address, '', $part);
--
Gitblit v1.9.1