From 197203727417a03d87053a47e5aa5175a76e3e0b Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Thu, 17 Oct 2013 04:24:53 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
program/steps/mail/list.inc | 48 +++++++++++++++++++++++++++++-------------------
1 files changed, 29 insertions(+), 19 deletions(-)
diff --git a/program/steps/mail/list.inc b/program/steps/mail/list.inc
index b5ee1b6..1a7d055 100644
--- a/program/steps/mail/list.inc
+++ b/program/steps/mail/list.inc
@@ -5,7 +5,7 @@
| program/steps/mail/list.inc |
| |
| This file is part of the Roundcube Webmail client |
- | Copyright (C) 2005-2007, Roundcube Dev. - Switzerland |
+ | Copyright (C) 2005-2007, The Roundcube Dev Team |
| Licensed under the GNU GPL |
| |
| PURPOSE: |
@@ -34,12 +34,6 @@
$_SESSION['sort_col'] = $save_arr['message_sort_col'] = $sort_col;
$_SESSION['sort_order'] = $save_arr['message_sort_order'] = $sort_order;
}
-else
-{
- // use session settings if set, defaults if not
- $sort_col = isset($_SESSION['sort_col']) ? $_SESSION['sort_col'] : $CONFIG['message_sort_col'];
- $sort_order = isset($_SESSION['sort_order']) ? $_SESSION['sort_order'] : $CONFIG['message_sort_order'];
-}
// is there a set of columns for this request?
if ($cols = get_input_value('_cols', RCUBE_INPUT_GET))
@@ -53,22 +47,34 @@
$mbox_name = $IMAP->get_mailbox_name();
+// Synchronize mailbox cache, handle flag changes
+$IMAP->mailbox_sync($mbox_name);
+
// initialize searching result if search_filter is used
if ($_SESSION['search_filter'] && $_SESSION['search_filter'] != 'ALL')
{
$search_request = md5($mbox_name.$_SESSION['search_filter']);
- $IMAP->search($mbox_name, $_SESSION['search_filter'], RCMAIL_CHARSET, $sort_col);
- $_SESSION['search'][$search_request] = $IMAP->get_search_set();
+ $IMAP->search($mbox_name, $_SESSION['search_filter'], RCMAIL_CHARSET, rcmail_sort_column());
+ $_SESSION['search'] = $IMAP->get_search_set();
+ $_SESSION['search_request'] = $search_request;
$OUTPUT->set_env('search_request', $search_request);
}
// fetch message headers
if ($count = $IMAP->messagecount($mbox_name, $IMAP->threading ? 'THREADS' : 'ALL', !empty($_REQUEST['_refresh'])))
- $a_headers = $IMAP->list_headers($mbox_name, NULL, $sort_col, $sort_order);
+ $a_headers = $IMAP->list_headers($mbox_name, NULL, rcmail_sort_column(), rcmail_sort_order());
// update search set (possible change of threading mode)
-if (!empty($_REQUEST['_search']) && isset($_SESSION['search'][$_REQUEST['_search']]))
- $_SESSION['search'][$_REQUEST['_search']] = $IMAP->get_search_set();
+if (!empty($_REQUEST['_search']) && isset($_SESSION['search'])
+ && $_SESSION['search_request'] == $_REQUEST['_search']
+) {
+ $_SESSION['search'] = $IMAP->get_search_set();
+}
+// remove old search data
+else if (empty($_REQUEST['_search']) && isset($_SESSION['search'])) {
+ $RCMAIL->session->remove('search');
+}
+
// empty result? we'll skip UNSEEN counting in rcmail_send_unread_count()
if (empty($search_request) && empty($a_headers)) {
@@ -84,7 +90,7 @@
$OUTPUT->set_env('pagecount', $pages);
$OUTPUT->set_env('threading', (bool) $IMAP->threading);
$OUTPUT->set_env('current_page', $count ? $IMAP->list_page : 1);
-$OUTPUT->command('set_rowcount', rcmail_get_messagecount_text($count));
+$OUTPUT->command('set_rowcount', rcmail_get_messagecount_text($count), $mbox_name);
$OUTPUT->command('set_mailboxname', rcmail_get_mailbox_name_text());
// add message rows
@@ -94,12 +100,16 @@
if ($search_request)
$OUTPUT->show_message('searchsuccessful', 'confirmation', array('nr' => $count));
}
-else if ($search_request)
- $OUTPUT->show_message('searchnomatch', 'notice');
-else
- $OUTPUT->show_message('nomessagesfound', 'notice');
+else {
+ // handle IMAP errors (e.g. #1486905)
+ if ($err_code = $IMAP->get_error_code()) {
+ rcmail_display_server_error();
+ }
+ else if ($search_request)
+ $OUTPUT->show_message('searchnomatch', 'notice');
+ else
+ $OUTPUT->show_message('nomessagesfound', 'notice');
+}
// send response
$OUTPUT->send();
-
-
--
Gitblit v1.9.1