Changeset 5061 in subversion

Timestamp:

Aug 12, 2011 3:39:39 PM (22 months ago)

Author:

thomasb

Message:

Backport XSS vulnerability fix to 0.5 branch

Location:

branches/release-0.5

Files:

• CHANGELOG (modified) (1 diff)
• program/include/rcube_json_output.php (modified) (1 diff)
• program/include/rcube_template.php (modified) (1 diff)

branches/release-0.5/CHANGELOG

@@ -2 +2 @@
 ===========================
 
+- Fix XSS vulnerability in UI messages (#1488030)
 - Fix identities "reply-to" and "bcc" fields have a bogus value when left empty (#1487943)
 - Fix issue which cases IMAP disconnection when encrypt() method was used (#1487900)

branches/release-0.5/program/include/rcube_json_output.php

@@ -170 +170 @@
     {
         if ($override || !$this->message) {
+            if (rcube_label_exists($message)) {
+                if (!empty($vars))
+                    $vars = array_map('Q', $vars);
+                $msgtext = rcube_label(array('name' => $message, 'vars' => $vars));
+            }
+            else
+                $msgtext = $message;
+
             $this->message = $message;
-            $this->command(
-                'display_message',
-                rcube_label(array('name' => $message, 'vars' => $vars)),
-                $type
-            );
+            $this->command('display_message', $msgtext, $type, $timeout * 1000);
         }
     }

branches/release-0.5/program/include/rcube_template.php

@@ -250 +250 @@
     {
         if ($override || !$this->message) {
+            if (rcube_label_exists($message)) {
+                if (!empty($vars))
+                    $vars = array_map('Q', $vars);
+                $msgtext = rcube_label(array('name' => $message, 'vars' => $vars));
+            }
+            else
+                $msgtext = $message;
+
             $this->message = $message;
-            $this->command(
-                'display_message',
-                rcube_label(array('name' => $message, 'vars' => $vars)),
-                $type);
+            $this->command('display_message', $msgtext, $type, $timeout * 1000);
         }
     }