From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

---
 program/include/rcmail.php |   47 +++++++++++++++++++++++++++++++++++++----------
 1 files changed, 37 insertions(+), 10 deletions(-)

diff --git a/program/include/rcmail.php b/program/include/rcmail.php
index c35c24f..01f7d1c 100644
--- a/program/include/rcmail.php
+++ b/program/include/rcmail.php
@@ -228,6 +228,11 @@
     }
 
     if (!$contacts) {
+      // there's no default, just return
+      if ($default) {
+        return null;
+      }
+
       self::raise_error(array(
         'code' => 700, 'type' => 'php',
         'file' => __FILE__, 'line' => __LINE__,
@@ -248,6 +253,23 @@
     }
 
     return $contacts;
+  }
+
+
+  /**
+   * Return identifier of the address book object
+   *
+   * @param rcube_addressbook Addressbook source object
+   *
+   * @return string Source identifier
+   */
+  public function get_address_book_id($object)
+  {
+    foreach ($this->address_books as $index => $book) {
+      if ($book === $object) {
+        return $index;
+      }
+    }
   }
 
 
@@ -290,7 +312,7 @@
         $list[$id] = array(
           'id'       => $id,
           'name'     => html::quote($prop['name']),
-          'groups'   => is_array($prop['groups']),
+          'groups'   => !empty($prop['groups']) || !empty($prop['group_filters']),
           'readonly' => !$prop['writable'],
           'hidden'   => $prop['hidden'],
           'autocomplete' => in_array($id, $autocomplete)
@@ -953,6 +975,10 @@
             'options' => $options,
         ));
 
+        if ($plugin['abort']) {
+            return isset($plugin['result']) ? $plugin['result'] : false;
+        }
+
         $from    = $plugin['from'];
         $mailto  = $plugin['mailto'];
         $options = $plugin['options'];
@@ -1049,7 +1075,7 @@
                     $subject    = str_replace("\r\n", $delim, $subject);
                 }
 
-                if (ini_get('safe_mode'))
+                if (filter_var(ini_get('safe_mode'), FILTER_VALIDATE_BOOLEAN))
                     $sent = mail($to, $subject, $msg_body, $header_str);
                 else
                     $sent = mail($to, $subject, $msg_body, $header_str, "-f$from");
@@ -1409,6 +1435,7 @@
             $js_mailboxlist = array();
             $out = html::tag('ul', $attrib, $rcmail->render_folder_tree_html($a_mailboxes, $mbox_name, $js_mailboxlist, $attrib), html::$common_attrib);
 
+            $rcmail->output->include_script('treelist.js');
             $rcmail->output->add_gui_object('mailboxlist', $attrib['id']);
             $rcmail->output->set_env('mailboxes', $js_mailboxlist);
             $rcmail->output->set_env('unreadwrap', $attrib['unreadwrap']);
@@ -1587,14 +1614,13 @@
                 'id' => "rcmli".$folder_id,
                 'class' => join(' ', $classes),
                 'noclose' => true),
-                html::a($link_attrib, $html_name) .
-                (!empty($folder['folders']) ? html::div(array(
-                    'class' => ($is_collapsed ? 'collapsed' : 'expanded'),
-                    'style' => "position:absolute",
-                    'onclick' => sprintf("%s.command('collapse-folder', '%s')", rcmail_output::JS_OBJECT_NAME, $js_name)
-                ), '&nbsp;') : ''));
+                html::a($link_attrib, $html_name));
 
-            $jslist[$folder_id] = array(
+            if (!empty($folder['folders'])) {
+                $out .= html::div('treetoggle ' . ($is_collapsed ? 'collapsed' : 'expanded'), '&nbsp;');
+            }
+
+            $jslist[$folder['id']] = array(
                 'id'      => $folder['id'],
                 'name'    => $foldername,
                 'virtual' => $folder['virtual']
@@ -1929,7 +1955,8 @@
     public function upload_init()
     {
         // Enable upload progress bar
-        if (($seconds = $this->config->get('upload_progress')) && ini_get('apc.rfc1867')) {
+        $rfc1867 = filter_var(ini_get('apc.rfc1867'), FILTER_VALIDATE_BOOLEAN);
+        if ($rfc1867 && ($seconds = $this->config->get('upload_progress'))) {
             if ($field_name = ini_get('apc.rfc1867_name')) {
                 $this->output->set_env('upload_progress_name', $field_name);
                 $this->output->set_env('upload_progress_time', (int) $seconds);

--
Gitblit v1.9.1