From 197203727417a03d87053a47e5aa5175a76e3e0b Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Thu, 17 Oct 2013 04:24:53 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
program/steps/mail/folders.inc | 85 ++++++++++++++++++++++++++----------------
1 files changed, 52 insertions(+), 33 deletions(-)
diff --git a/program/steps/mail/folders.inc b/program/steps/mail/folders.inc
index 69f3c0e..fad2bf3 100644
--- a/program/steps/mail/folders.inc
+++ b/program/steps/mail/folders.inc
@@ -4,8 +4,8 @@
+-----------------------------------------------------------------------+
| program/steps/mail/folders.inc |
| |
- | This file is part of the RoundCube Webmail client |
- | Copyright (C) 2005-2007, RoundCube Dev. - Switzerland |
+ | This file is part of the Roundcube Webmail client |
+ | Copyright (C) 2005-2009, The Roundcube Dev Team |
| Licensed under the GNU GPL |
| |
| PURPOSE: |
@@ -18,44 +18,63 @@
$Id$
*/
-$mbox_name = $IMAP->get_mailbox_name();
+// only process ajax requests
+if (!$OUTPUT->ajax_call)
+ return;
+
+$mbox = get_input_value('_mbox', RCUBE_INPUT_POST, true);
// send EXPUNGE command
-if ($RCMAIL->action=='expunge' && ($mbox = get_input_value('_mbox', RCUBE_INPUT_POST)))
-{
- $success = $IMAP->expunge($mbox);
+if ($RCMAIL->action == 'expunge') {
- // reload message list if current mailbox
- if ($success && !empty($_REQUEST['_reload']))
- {
- $OUTPUT->command('message_list.clear');
- $RCMAIL->action = 'list';
- return;
- }
- else
- $commands = "// expunged: $success\n";
+ $success = $IMAP->expunge($mbox);
+
+ // reload message list if current mailbox
+ if ($success) {
+ $OUTPUT->show_message('folderexpunged', 'confirmation');
+
+ if (!empty($_REQUEST['_reload'])) {
+ $OUTPUT->command('set_quota', rcmail_quota_content());
+ $OUTPUT->command('message_list.clear');
+ $RCMAIL->action = 'list';
+ return;
+ }
+ }
+ else {
+ rcmail_display_server_error();
+ }
}
// clear mailbox
-else if ($RCMAIL->action=='purge' && ($mbox = get_input_value('_mbox', RCUBE_INPUT_POST)))
+else if ($RCMAIL->action == 'purge')
{
- // we should only be purging trash and junk
- if($mbox == $CONFIG['trash_mbox'] || $mbox == $CONFIG['junk_mbox'])
- {
- $success = $IMAP->clear_mailbox($mbox);
-
- if ($success && !empty($_REQUEST['_reload']))
- {
- $OUTPUT->set_env('messagecount', 0);
- $OUTPUT->set_env('pagecount', 0);
- $OUTPUT->command('message_list.clear');
- $OUTPUT->command('set_rowcount', rcmail_get_messagecount_text());
- $OUTPUT->command('set_unread_count', $mbox_name, 0);
+ $delimiter = $IMAP->get_hierarchy_delimiter();
+ $trash_regexp = '/^' . preg_quote($CONFIG['trash_mbox'] . $delimiter, '/') . '/';
+ $junk_regexp = '/^' . preg_quote($CONFIG['junk_mbox'] . $delimiter, '/') . '/';
+
+ // we should only be purging trash and junk (or their subfolders)
+ if ($mbox == $CONFIG['trash_mbox'] || $mbox == $CONFIG['junk_mbox']
+ || preg_match($trash_regexp, $mbox) || preg_match($junk_regexp, $mbox)
+ ) {
+ $success = $IMAP->clear_mailbox($mbox);
+
+ if ($success) {
+ $OUTPUT->show_message('folderpurged', 'confirmation');
+
+ if (!empty($_REQUEST['_reload'])) {
+ $OUTPUT->set_env('messagecount', 0);
+ $OUTPUT->set_env('pagecount', 0);
+ $OUTPUT->command('message_list.clear');
+ $OUTPUT->command('set_rowcount', rcmail_get_messagecount_text(), $mbox);
+ $OUTPUT->command('set_unread_count', $mbox, 0);
+ $OUTPUT->command('set_quota', rcmail_quota_content());
+ rcmail_set_unseen_count($mbox, 0);
+ }
+ }
+ else {
+ rcmail_display_server_error();
+ }
}
- else
- $commands = "// purged: $success";
- }
}
-$OUTPUT->send($commands);
-?>
+$OUTPUT->send();
--
Gitblit v1.9.1