Changeset 5037 in subversion for trunk/roundcubemail/program/include/rcube_template.php

Timestamp:

Aug 9, 2011 2:40:42 PM (22 months ago)

Author:

alec

Message:

• Fix XSS vulnerability in UI messages (#1488030)

File:

• trunk/roundcubemail/program/include/rcube_template.php (modified) (1 diff)

trunk/roundcubemail/program/include/rcube_template.php

@@ -249 +249 @@
     {
         if ($override || !$this->message) {
+            if (rcube_label_exists($message)) {
+                if (!empty($vars))
+                    $vars = array_map('Q', $vars);
+                $msgtext = rcube_label(array('name' => $message, 'vars' => $vars));
+            }
+            else
+                $msgtext = $message;
+
             $this->message = $message;
-            $msgtext = rcube_label_exists($message) ? rcube_label(array('name' => $message, 'vars' => $vars)) : $message;
             $this->command('display_message', $msgtext, $type, $timeout * 1000);
         }