From f06aa8058b7e32ba32d4551074b6e0b8a300f751 Mon Sep 17 00:00:00 2001
From: Thomas Bruederli <thomas@roundcube.net>
Date: Mon, 21 Oct 2013 15:02:40 -0400
Subject: [PATCH] Bump version after security fix
---
program/steps/settings/save_identity.inc | 53 +++++++++++++++++++++++++++++------------------------
1 files changed, 29 insertions(+), 24 deletions(-)
diff --git a/program/steps/settings/save_identity.inc b/program/steps/settings/save_identity.inc
index f88e732..c488196 100644
--- a/program/steps/settings/save_identity.inc
+++ b/program/steps/settings/save_identity.inc
@@ -6,7 +6,10 @@
| |
| This file is part of the Roundcube Webmail client |
| Copyright (C) 2005-2009, The Roundcube Dev Team |
- | Licensed under the GNU GPL |
+ | |
+ | Licensed under the GNU General Public License version 3 or |
+ | any later version with exceptions for skins & plugins. |
+ | See the README file for a full license statement. |
| |
| PURPOSE: |
| Save an identity record or to add a new one |
@@ -22,7 +25,6 @@
define('IDENTITIES_LEVEL', intval($RCMAIL->config->get('identities_level', 0)));
$a_save_cols = array('name', 'email', 'organization', 'reply-to', 'bcc', 'standard', 'signature', 'html_signature');
-$a_html_cols = array('signature', 'name', 'organization');
$a_boolean_cols = array('standard', 'html_signature');
$updated = $default_id = false;
@@ -40,7 +42,7 @@
{
$fname = '_'.$col;
if (isset($_POST[$fname]))
- $save_data[$col] = get_input_value($fname, RCUBE_INPUT_POST, in_array($col, $a_html_cols));
+ $save_data[$col] = get_input_value($fname, RCUBE_INPUT_POST, true);
}
// set "off" values for checkboxes that were not checked, and therefore
@@ -57,15 +59,18 @@
unset($save_data['email']);
// Validate e-mail addresses
-foreach (array('email', 'reply-to', 'bcc') as $item) {
- if ($email = $save_data[$item]) {
- $ascii_email = rcube_idn_to_ascii($email);
- if (!check_email($ascii_email)) {
- // show error message
- $OUTPUT->show_message('emailformaterror', 'error', array('email' => $email), false);
- rcmail_overwrite_action('edit-identity');
- return;
- }
+$email_checks = array(rcube_idn_to_ascii($save_data['email']));
+foreach (array('reply-to', 'bcc') as $item) {
+ foreach (rcube_mime::decode_address_list($save_data[$item], null, false) as $rcpt)
+ $email_checks[] = rcube_idn_to_ascii($rcpt['mailto']);
+}
+
+foreach ($email_checks as $email) {
+ if ($email && !check_email($email)) {
+ // show error message
+ $OUTPUT->show_message('emailformaterror', 'error', array('email' => rcube_idn_to_utf8($email)), false);
+ rcmail_overwrite_action('edit-identity');
+ return;
}
}
@@ -78,11 +83,6 @@
if ($save_data['email'])
$save_data['email'] = rcube_idn_to_ascii($save_data['email']);
- if ($save_data['bcc'])
- $save_data['bcc'] = rcube_idn_to_ascii($save_data['bcc']);
- if ($save_data['reply-to'])
- $save_data['reply-to'] = rcube_idn_to_ascii($save_data['reply-to']);
-
if (!$plugin['abort'])
$updated = $RCMAIL->user->update_identity($iid, $save_data);
else
@@ -96,7 +96,7 @@
if ($_POST['_framed']) {
// update the changed col in list
- // ...
+ $OUTPUT->command('parent.update_identity_row', $iid, Q(trim($save_data['name'] . ' <' . rcube_idn_to_utf8($save_data['email']) .'>')));
}
}
else {
@@ -117,11 +117,7 @@
$save_data = $plugin['record'];
if ($save_data['email'])
- $save_data['email'] = rcube_idn_to_ascii($save_data['email']);
- if ($save_data['bcc'])
- $save_data['bcc'] = rcube_idn_to_ascii($save_data['bcc']);
- if ($save_data['reply-to'])
- $save_data['reply-to'] = rcube_idn_to_ascii($save_data['reply-to']);
+ $save_data['email'] = rcube_idn_to_ascii($save_data['email']);
if (!$plugin['abort'])
$insert_id = $save_data['email'] ? $RCMAIL->user->insert_identity($save_data) : null;
@@ -135,6 +131,11 @@
if (!empty($_POST['_standard']))
$default_id = $insert_id;
+
+ if ($_POST['_framed']) {
+ // add a new row to the list
+ $OUTPUT->command('parent.update_identity_row', $insert_id, Q(trim($save_data['name'] . ' <' . rcube_idn_to_utf8($save_data['email']) .'>')), true);
+ }
}
else {
// show error message
@@ -152,4 +153,8 @@
$RCMAIL->user->set_default($default_id);
// go to next step
-rcmail_overwrite_action('identities');
+if (!empty($_REQUEST['_framed'])) {
+ rcmail_overwrite_action('edit-identity');
+}
+else
+ rcmail_overwrite_action('identities');
--
Gitblit v1.9.1