Changeset 4814 in subversion

Timestamp:

May 27, 2011 9:20:46 AM (2 years ago)

Author:

alec

Message:

• Fix handling of "<" character in group name

File:

• trunk/roundcubemail/program/steps/addressbook/groups.inc (modified) (4 diffs)

trunk/roundcubemail/program/steps/addressbook/groups.inc

@@ -69 +69 @@
 
 else if ($RCMAIL->action == 'group-create') {
-  if ($name = trim(get_input_value('_name', RCUBE_INPUT_POST))) {
+  if ($name = trim(get_input_value('_name', RCUBE_INPUT_POST, true))) {
     $plugin = $RCMAIL->plugins->exec_hook('group_create', array('name' => $name, 'source' => $source));
 
@@ -79 +79 @@
 
   if ($created && $OUTPUT->ajax_call) {
+    $created['name'] = Q($created['name']);
     $OUTPUT->show_message('groupcreated', 'confirmation');
     $OUTPUT->command('insert_contact_group', array('source' => $source) + $created);
@@ -88 +89 @@
 
 else if ($RCMAIL->action == 'group-rename') {
-  if (($gid = get_input_value('_gid', RCUBE_INPUT_POST)) && ($name = trim(get_input_value('_name', RCUBE_INPUT_POST)))) {
+  if (($gid = get_input_value('_gid', RCUBE_INPUT_POST)) && ($name = trim(get_input_value('_name', RCUBE_INPUT_POST, true)))) {
     $plugin = $RCMAIL->plugins->exec_hook('group_rename', array('group_id' => $gid, 'name' => $name, 'source' => $source));
 
@@ -100 +101 @@
     $OUTPUT->show_message('grouprenamed', 'confirmation');
     $OUTPUT->command('update_contact_group', array(
-      'source' => $source, 'id' => $gid, 'name' => $newname, 'newid' => $newgid));
+      'source' => $source, 'id' => $gid, 'name' => Q($newname), 'newid' => $newgid));
   }
   else if (!$newname)