From f06aa8058b7e32ba32d4551074b6e0b8a300f751 Mon Sep 17 00:00:00 2001
From: Thomas Bruederli <thomas@roundcube.net>
Date: Mon, 21 Oct 2013 15:02:40 -0400
Subject: [PATCH] Bump version after security fix
---
program/include/rcube_contacts.php | 38 ++++++++++++++++++++++++--------------
1 files changed, 24 insertions(+), 14 deletions(-)
diff --git a/program/include/rcube_contacts.php b/program/include/rcube_contacts.php
index ab3b181..3e30043 100644
--- a/program/include/rcube_contacts.php
+++ b/program/include/rcube_contacts.php
@@ -5,8 +5,11 @@
| program/include/rcube_contacts.php |
| |
| This file is part of the Roundcube Webmail client |
- | Copyright (C) 2006-2011, The Roundcube Dev Team |
- | Licensed under the GNU GPL |
+ | Copyright (C) 2006-2012, The Roundcube Dev Team |
+ | |
+ | Licensed under the GNU General Public License version 3 or |
+ | any later version with exceptions for skins & plugins. |
+ | See the README file for a full license statement. |
| |
| PURPOSE: |
| Interface to the local address book database |
@@ -31,6 +34,7 @@
protected $db_name = 'contacts';
protected $db_groups = 'contactgroups';
protected $db_groupmembers = 'contactgroupmembers';
+ protected $vcard_fieldmap = array();
/**
* Store database connection.
@@ -213,6 +217,16 @@
$join = " LEFT JOIN ".get_table_name($this->db_groupmembers)." AS m".
" ON (m.contact_id = c.".$this->primary_key.")";
+ $order_col = (in_array($this->sort_col, $this->table_cols) ? $this->sort_col : 'name');
+ $order_cols = array('c.'.$order_col);
+ if ($order_col == 'firstname')
+ $order_cols[] = 'c.surname';
+ else if ($order_col == 'surname')
+ $order_cols[] = 'c.firstname';
+ if ($order_col != 'name')
+ $order_cols[] = 'c.name';
+ $order_cols[] = 'c.email';
+
$sql_result = $this->db->limitquery(
"SELECT * FROM ".get_table_name($this->db_name)." AS c" .
$join .
@@ -220,7 +234,8 @@
" AND c.user_id=?" .
($this->group_id ? " AND m.contactgroup_id=?" : "").
($this->filter ? " AND (".$this->filter.")" : "") .
- " ORDER BY ". $this->db->concat('c.name', 'c.email'),
+ " ORDER BY ". $this->db->concat($order_cols) .
+ " " . $this->sort_order,
$start_row,
$length,
$this->user_id,
@@ -237,13 +252,6 @@
else {
$sql_arr['email'] = explode(self::SEPARATOR, $sql_arr['email']);
$sql_arr['email'] = array_map('trim', $sql_arr['email']);
- }
-
- // make sure we have a name to display
- if (empty($sql_arr['name'])) {
- if (empty($sql_arr['email']))
- $sql_arr['email'] = $this->get_col_values('email', $sql_arr, true);
- $sql_arr['name'] = $sql_arr['email'][0];
}
$this->result->add($sql_arr);
@@ -692,7 +700,7 @@
if ($sql_arr['vcard']) {
unset($sql_arr['email']);
- $vcard = new rcube_vcard($sql_arr['vcard']);
+ $vcard = new rcube_vcard($sql_arr['vcard'], RCMAIL_CHARSET, false, $this->vcard_fieldmap);
$record += $vcard->get_assoc() + $sql_arr;
}
else {
@@ -711,7 +719,7 @@
$words = '';
// copy values into vcard object
- $vcard = new rcube_vcard($record['vcard'] ? $record['vcard'] : $save_data['vcard']);
+ $vcard = new rcube_vcard($record['vcard'] ? $record['vcard'] : $save_data['vcard'], RCMAIL_CHARSET, false, $this->vcard_fieldmap);
$vcard->reset();
foreach ($save_data as $key => $values) {
list($field, $section) = explode(':', $key);
@@ -875,7 +883,7 @@
* @param string New name to set for this group
* @return boolean New name on success, false if no data was changed
*/
- function rename_group($gid, $newname)
+ function rename_group($gid, $newname, &$new_gid)
{
// make sure we have a unique name
$name = $this->unique_groupname($newname);
@@ -929,7 +937,9 @@
$contact_id
);
- if (!$this->db->db_error)
+ if ($this->db->db_error)
+ $this->set_error(self::ERROR_SAVING, $this->db->db_error_msg);
+ else
$added++;
}
--
Gitblit v1.9.1