Changeset 382 in subversion

Timestamp:

Nov 22, 2006 6:42:37 AM (7 years ago)

Author:

thomasb

Message:

Fixed XSS vulnerability (Bug #1484109)

Location:

trunk/roundcubemail

Files:

• index.php (modified) (4 diffs)
• program/include/main.inc (modified) (1 diff)

trunk/roundcubemail/index.php

@@ -3 +3 @@
  +-----------------------------------------------------------------------+
  | RoundCube Webmail IMAP Client                                         |
- | Version 0.1-20060907                                                  |
+ | Version 0.1-20061122                                                  |
  |                                                                       |
  | Copyright (C) 2005-2006, RoundCube Dev. - Switzerland                 |
@@ -41 +41 @@
 */
 
-define('RCMAIL_VERSION', '0.1-20060907');
+define('RCMAIL_VERSION', '0.1-20061122');
 
 // define global vars
@@ -91 +91 @@
 
 // catch some url/post parameters
-$_task = get_input_value('_task', RCUBE_INPUT_GPC);
-$_action = get_input_value('_action', RCUBE_INPUT_GPC);
+$_task = strip_quotes(get_input_value('_task', RCUBE_INPUT_GPC));
+$_action = strip_quotes(get_input_value('_action', RCUBE_INPUT_GPC));
 $_framed = (!empty($_GET['_framed']) || !empty($_POST['_framed']));
 
-if (empty($_task))
+// use main task if empty or invalid value
+if (empty($_task) || !in_array($_task, $MAIN_TASKS))
   $_task = 'mail';
 
@@ -373 +374 @@
 
 // parse main template
-// only allow these templates to be included
-if (in_array($_task, $MAIN_TASKS))
-  parse_template($_task);
+parse_template($_task);
 
 

trunk/roundcubemail/program/include/main.inc

@@ -1064 +1064 @@
   }
 
-
+/**
+ * Remove single and double quotes from given string
+ */
+function strip_quotes($str)
+{
+  return preg_replace('/[\'"]/', '', $str);
+}