Changeset 482 in subversion

Timestamp:

Feb 16, 2007 9:38:12 AM (6 years ago)

Author:

robin

Message:

Fix XSS vulnerability (closes #1484254).

File:

• trunk/roundcubemail/program/steps/mail/func.inc (modified) (1 diff)

trunk/roundcubemail/program/steps/mail/func.inc

@@ -31 +31 @@
 
 // set imap properties and session vars
-if (strlen($_GET['_mbox']))
-  {
-  $IMAP->set_mailbox($_GET['_mbox']);
-  $_SESSION['mbox'] = $_GET['_mbox'];
+if (strlen($mbox = get_input_value('_mbox', RCUBE_INPUT_GET)))
+  {
+  $IMAP->set_mailbox($mbox);
+  $_SESSION['mbox'] = $mbox;
   }