From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
program/include/bc.php | 33 ++++++++++++++++++++++++++-------
1 files changed, 26 insertions(+), 7 deletions(-)
diff --git a/program/include/bc.php b/program/include/bc.php
index 8a3d4f9..af2e512 100644
--- a/program/include/bc.php
+++ b/program/include/bc.php
@@ -23,6 +23,7 @@
* Roundcube Webmail deprecated functions
*
* @package Core
+ * @subpackage Legacy
* @author Thomas Bruederli <roundcube@gmail.com>
*/
@@ -31,7 +32,8 @@
define('RCUBE_INPUT_POST', rcube_utils::INPUT_POST);
define('RCUBE_INPUT_GPC', rcube_utils::INPUT_GPC);
-define('JS_OBJECT_NAME', rcmail::JS_OBJECT_NAME);
+define('JS_OBJECT_NAME', rcmail_output::JS_OBJECT_NAME);
+define('RCMAIL_CHARSET', RCUBE_CHARSET);
function get_table_name($table)
{
@@ -83,19 +85,19 @@
return rcube_output::json_serialize($input);
}
-function rep_specialchars_output($str, $enctype='', $mode='', $newlines=TRUE)
+function rep_specialchars_output($str, $enctype='', $mode='', $newlines=true)
{
return rcube_utils::rep_specialchars_output($str, $enctype, $mode, $newlines);
}
-function Q($str, $mode='strict', $newlines=TRUE)
+function Q($str, $mode='strict', $newlines=true)
{
- return rcmail::Q($str, $mode, $newlines);
+ return rcube_utils::rep_specialchars_output($str, 'html', $mode, $newlines);
}
function JQ($str)
{
- return rcmail::JQ($str);
+ return rcube_utils::rep_specialchars_output($str, 'js');
}
function get_input_value($fname, $source, $allow_html=FALSE, $charset=NULL)
@@ -125,7 +127,7 @@
function rcmail_get_edit_field($col, $value, $attrib, $type='text')
{
- return rcube_utils::get_edit_field($col, $value, $attrib, $type);
+ return rcube_output::get_edit_field($col, $value, $attrib, $type);
}
function rcmail_mod_css_styles($source, $container_id, $allow_remote=false)
@@ -285,7 +287,7 @@
function rcube_check_referer()
{
- return rcmail::check_referer();
+ return rcube_utils::check_referer();
}
function rcube_timer()
@@ -397,3 +399,20 @@
{
return rcube_utils::get_boolean($str);
}
+
+function enriched_to_html($data)
+{
+ return rcube_enriched::to_html($data);
+}
+
+class rcube_html_page extends rcmail_html_page
+{
+}
+
+class washtml extends rcube_washtml
+{
+}
+
+class html2text extends rcube_html2text
+{
+}
--
Gitblit v1.9.1