Changeset 8dd172a in github for program/include/rcube_json_output.php

Timestamp:

Aug 9, 2011 2:40:42 PM (22 months ago)

Author:

alecpl <alec@…>

Branches:

master, HEAD, courier-fix, dev-browser-capabilities, pdo, release-0.6, release-0.7, release-0.8

Children:

4c24246

Parents:

2185899

Message:

• Fix XSS vulnerability in UI messages (#1488030)

File:

• program/include/rcube_json_output.php (modified) (1 diff)

program/include/rcube_json_output.php

@@ -175 +175 @@
     {
         if ($override || !$this->message) {
+            if (rcube_label_exists($message)) {
+                if (!empty($vars))
+                    $vars = array_map('Q', $vars);
+                $msgtext = rcube_label(array('name' => $message, 'vars' => $vars));
+            }
+            else
+                $msgtext = $message;
+
             $this->message = $message;
-            $msgtext = rcube_label_exists($message) ? rcube_label(array('name' => $message, 'vars' => $vars)) : $message;
             $this->command('display_message', $msgtext, $type, $timeout * 1000);
         }