From 197203727417a03d87053a47e5aa5175a76e3e0b Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Thu, 17 Oct 2013 04:24:53 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
program/steps/settings/save_identity.inc | 211 +++++++++++++++++++++++++++++-----------------------
1 files changed, 118 insertions(+), 93 deletions(-)
diff --git a/program/steps/settings/save_identity.inc b/program/steps/settings/save_identity.inc
index ea186ec..f493f73 100644
--- a/program/steps/settings/save_identity.inc
+++ b/program/steps/settings/save_identity.inc
@@ -4,8 +4,8 @@
+-----------------------------------------------------------------------+
| program/steps/settings/save_identity.inc |
| |
- | This file is part of the RoundCube Webmail client |
- | Copyright (C) 2005, RoundCube Dev. - Switzerland |
+ | This file is part of the Roundcube Webmail client |
+ | Copyright (C) 2005-2009, The Roundcube Dev Team |
| Licensed under the GNU GPL |
| |
| PURPOSE: |
@@ -19,112 +19,137 @@
*/
-$a_save_cols = array('name', 'email', 'organization', 'reply-to', 'bcc', 'default');
+define('IDENTITIES_LEVEL', intval($RCMAIL->config->get('identities_level', 0)));
+$a_save_cols = array('name', 'email', 'organization', 'reply-to', 'bcc', 'standard', 'signature', 'html_signature');
+$a_html_cols = array('signature', 'name', 'organization');
+$a_boolean_cols = array('standard', 'html_signature');
+$updated = $default_id = false;
+
+// check input
+if (empty($_POST['_name']) || (empty($_POST['_email']) && IDENTITIES_LEVEL != 1 && IDENTITIES_LEVEL != 3))
+{
+ $OUTPUT->show_message('formincomplete', 'warning');
+ rcmail_overwrite_action('edit-identity');
+ return;
+}
+
+
+$save_data = array();
+foreach ($a_save_cols as $col)
+{
+ $fname = '_'.$col;
+ if (isset($_POST[$fname]))
+ $save_data[$col] = get_input_value($fname, RCUBE_INPUT_POST, in_array($col, $a_html_cols));
+}
+
+// set "off" values for checkboxes that were not checked, and therefore
+// not included in the POST body.
+foreach ($a_boolean_cols as $col)
+{
+ $fname = '_' . $col;
+ if (!isset($_POST[$fname]))
+ $save_data[$col] = 0;
+}
+
+// unset email address if user has no rights to change it
+if (IDENTITIES_LEVEL == 1 || IDENTITIES_LEVEL == 3)
+ unset($save_data['email']);
+
+// Validate e-mail addresses
+foreach (array('email', 'reply-to', 'bcc') as $item) {
+ if ($email = $save_data[$item]) {
+ $ascii_email = rcube_idn_to_ascii($email);
+ if (!check_email($ascii_email)) {
+ // show error message
+ $OUTPUT->show_message('emailformaterror', 'error', array('email' => $email), false);
+ rcmail_overwrite_action('edit-identity');
+ return;
+ }
+ }
+}
// update an existing contact
if ($_POST['_iid'])
- {
- $a_write_sql = array();
+{
+ $iid = get_input_value('_iid', RCUBE_INPUT_POST);
+ $plugin = $RCMAIL->plugins->exec_hook('identity_update', array('id' => $iid, 'record' => $save_data));
+ $save_data = $plugin['record'];
- foreach ($a_save_cols as $col)
- {
- $fname = '_'.$col;
- if (!isset($_POST[$fname]))
- continue;
+ if ($save_data['email'])
+ $save_data['email'] = rcube_idn_to_ascii($save_data['email']);
+ if ($save_data['bcc'])
+ $save_data['bcc'] = rcube_idn_to_ascii($save_data['bcc']);
+ if ($save_data['reply-to'])
+ $save_data['reply-to'] = rcube_idn_to_ascii($save_data['reply-to']);
- $a_write_sql[] = sprintf("`%s`='%s'", $col, addslashes(strip_tags($_POST[$fname])));
- }
-
- if (sizeof($a_write_sql))
- {
- $DB->query("UPDATE ".get_table_name('identities')."
- SET ".join(', ', $a_write_sql)."
- WHERE identity_id=?
- AND user_id=?
- AND del<>'1'",
- $_POST['_iid'],
- $_SESSION['user_id']);
-
- $updated = $DB->affected_rows();
- }
-
- if ($updated)
- {
- show_message('successfullysaved', 'confirmation');
-
- // mark all other identities as 'not-default'
- $DB->query("UPDATE ".get_table_name('identities')."
- SET ".$DB->quoteIdentifier('default')."='0'
- WHERE identity_id!=?
- AND user_id=?
- AND del<>'1'",
- $_POST['_iid'],
- $_SESSION['user_id']);
-
- if ($_POST['_framed'])
- {
- // update the changed col in list
- // ...
- }
- }
+ if (!$plugin['abort'])
+ $updated = $USER->update_identity($iid, $save_data);
else
- {
- // show error message
+ $updated = $plugin['result'];
+ if ($updated) {
+ $OUTPUT->show_message('successfullysaved', 'confirmation');
+
+ if (!empty($_POST['_standard']))
+ $default_id = get_input_value('_iid', RCUBE_INPUT_POST);
+
+ if ($_POST['_framed']) {
+ // update the changed col in list
+ // ...
}
}
+ else {
+ // show error message
+ $OUTPUT->show_message($plugin['message'] ? $plugin['message'] : 'errorsaving', 'error', null, false);
+ rcmail_overwrite_action('edit-identity');
+ return;
+ }
+}
-// insert a new contact
-else
- {
- $a_insert_cols = $a_insert_values = array();
+// insert a new identity record
+else if (IDENTITIES_LEVEL < 2)
+{
+ if (IDENTITIES_LEVEL == 1)
+ $save_data['email'] = $RCMAIL->user->get_username();
- foreach ($a_save_cols as $col)
- {
- $fname = '_'.$col;
- if (!isset($_POST[$fname]))
- continue;
-
- $a_insert_cols[] = $DB->quoteIdentifier($col);
- $a_insert_values[] = sprintf("'%s'", addslashes(strip_tags($_POST[$fname])));
- }
-
- if (sizeof($a_insert_cols))
- {
- $DB->query("INSERT INTO ".get_table_name('identities')."
- (user_id, ".join(', ', $a_insert_cols).")
- VALUES (?, ".join(', ', $a_insert_values).")",
- $_SESSION['user_id']);
-
- $insert_id = $DB->insert_id();
- }
-
- if ($insert_id)
- {
+ $plugin = $RCMAIL->plugins->exec_hook('identity_create', array('record' => $save_data));
+ $save_data = $plugin['record'];
+
+ if ($save_data['email'])
+ $save_data['email'] = rcube_idn_to_ascii($save_data['email']);
+ if ($save_data['bcc'])
+ $save_data['bcc'] = rcube_idn_to_ascii($save_data['bcc']);
+ if ($save_data['reply-to'])
+ $save_data['reply-to'] = rcube_idn_to_ascii($save_data['reply-to']);
+
+ if (!$plugin['abort'])
+ $insert_id = $save_data['email'] ? $USER->insert_identity($save_data) : null;
+ else
+ $insert_id = $plugin['result'];
+
+ if ($insert_id) {
+ $OUTPUT->show_message('successfullysaved', 'confirmation', null, false);
+
$_GET['_iid'] = $insert_id;
- if ($_POST['_framed'])
- {
- // add contact row or jump to the page where it should appear
- // ....
- }
- }
- else
- {
- // show error message
- }
+ if (!empty($_POST['_standard']))
+ $default_id = $insert_id;
}
+ else {
+ // show error message
+ $OUTPUT->show_message($plugin['message'] ? $plugin['message'] : 'errorsaving', 'error', null, false);
+ rcmail_overwrite_action('edit-identity');
+ return;
+ }
+}
+else
+ $OUTPUT->show_message('opnotpermitted', 'error');
+
+// mark all other identities as 'not-default'
+if ($default_id)
+ $USER->set_default($default_id);
// go to next step
-if ($_POST['_framed'])
- $_action = 'edit-identitiy';
-else
- $_action = 'identities';
-
-
-// overwrite action variable
-$OUTPUT->add_script(sprintf("\n%s.set_env('action', '%s');", $JS_OBJECT_NAME, $_action));
-
-?>
\ No newline at end of file
+rcmail_overwrite_action('identities');
--
Gitblit v1.9.1