From 037af6890fe6fdb84a08d3c86083e847c90ec0ad Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Oct 2013 08:17:26 -0400
Subject: [PATCH] Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)
---
program/lib/Roundcube/bootstrap.php | 84 ++++++++++++++++++++++++++++++++----------
1 files changed, 64 insertions(+), 20 deletions(-)
diff --git a/program/lib/Roundcube/bootstrap.php b/program/lib/Roundcube/bootstrap.php
index bc0456c..ed4c2fa 100644
--- a/program/lib/Roundcube/bootstrap.php
+++ b/program/lib/Roundcube/bootstrap.php
@@ -2,10 +2,8 @@
/*
+-----------------------------------------------------------------------+
- | program/include/bootstrap.php |
- | |
| This file is part of the Roundcube PHP suite |
- | Copyright (C) 2005-2012, The Roundcube Dev Team |
+ | Copyright (C) 2005-2013, The Roundcube Dev Team |
| |
| Licensed under the GNU General Public License version 3 or |
| any later version with exceptions for skins & plugins. |
@@ -13,7 +11,6 @@
| |
| CONTENTS: |
| Roundcube Framework Initialization |
- | |
+-----------------------------------------------------------------------+
| Author: Thomas Bruederli <roundcube@gmail.com> |
| Author: Aleksander Machniak <alec@alec.pl> |
@@ -34,36 +31,67 @@
// critical PHP settings here. Only these, which doesn't provide
// an error/warning in the logs later. See (#1486307).
'mbstring.func_overload' => 0,
- 'suhosin.session.encrypt' => 0,
- 'session.auto_start' => 0,
- 'file_uploads' => 1,
'magic_quotes_runtime' => 0,
'magic_quotes_sybase' => 0, // #1488506
);
+
+// check these additional ini settings if not called via CLI
+if (php_sapi_name() != 'cli') {
+ $config += array(
+ 'suhosin.session.encrypt' => 0,
+ 'session.auto_start' => 0,
+ 'file_uploads' => 1,
+ );
+}
+
foreach ($config as $optname => $optval) {
- if ($optval != ini_get($optname) && @ini_set($optname, $optval) === false) {
- die("ERROR: Wrong '$optname' option value and it wasn't possible to set it to required value ($optval).\n"
- ."Check your PHP configuration (including php_admin_flag).");
+ $ini_optval = filter_var(ini_get($optname), FILTER_VALIDATE_BOOLEAN);
+ if ($optval != $ini_optval && @ini_set($optname, $optval) === false) {
+ $error = "ERROR: Wrong '$optname' option value and it wasn't possible to set it to required value ($optval).\n"
+ . "Check your PHP configuration (including php_admin_flag).";
+ if (defined('STDERR')) fwrite(STDERR, $error); else echo $error;
+ exit(1);
}
}
-// application constants
-define('RCMAIL_VERSION', '0.9-git');
-define('RCMAIL_CHARSET', 'UTF-8');
-define('RCMAIL_START', microtime(true));
+// framework constants
+define('RCUBE_VERSION', '0.9.4');
+define('RCUBE_CHARSET', 'UTF-8');
-if (!defined('INSTALL_PATH')) {
- define('INSTALL_PATH', dirname($_SERVER['SCRIPT_FILENAME']).'/');
+if (!defined('RCUBE_LIB_DIR')) {
+ define('RCUBE_LIB_DIR', dirname(__FILE__).'/');
}
-if (!defined('RCMAIL_CONFIG_DIR')) {
- define('RCMAIL_CONFIG_DIR', INSTALL_PATH . 'config');
+if (!defined('RCUBE_INSTALL_PATH')) {
+ define('RCUBE_INSTALL_PATH', RCUBE_LIB_DIR);
+}
+
+if (!defined('RCUBE_CONFIG_DIR')) {
+ define('RCUBE_CONFIG_DIR', RCUBE_INSTALL_PATH . 'config/');
+}
+
+if (!defined('RCUBE_PLUGINS_DIR')) {
+ define('RCUBE_PLUGINS_DIR', RCUBE_INSTALL_PATH . 'plugins/');
+}
+
+if (!defined('RCUBE_LOCALIZATION_DIR')) {
+ define('RCUBE_LOCALIZATION_DIR', RCUBE_INSTALL_PATH . 'localization/');
}
// set internal encoding for mbstring extension
if (extension_loaded('mbstring')) {
- mb_internal_encoding(RCMAIL_CHARSET);
- @mb_regex_encoding(RCMAIL_CHARSET);
+ mb_internal_encoding(RCUBE_CHARSET);
+ @mb_regex_encoding(RCUBE_CHARSET);
+}
+
+// make sure the Roundcube lib directory is in the include_path
+$rcube_path = realpath(RCUBE_LIB_DIR . '..');
+$sep = PATH_SEPARATOR;
+$regexp = "!(^|$sep)" . preg_quote($rcube_path, '!') . "($sep|\$)!";
+$path = ini_get('include_path');
+
+if (!preg_match($regexp, $path)) {
+ set_include_path($path . PATH_SEPARATOR . $rcube_path);
}
// Register autoloader
@@ -350,6 +378,22 @@
/**
+ * Fix version number so it can be used correctly in version_compare()
+ *
+ * @param string $version Version number string
+ *
+ * @param return Version number string
+ */
+function version_parse($version)
+{
+ return str_replace(
+ array('-stable', '-git'),
+ array('.0', '.99'),
+ $version);
+}
+
+
+/**
* mbstring replacement functions
*/
if (!extension_loaded('mbstring'))
--
Gitblit v1.9.1