Changeset b3ce791 in github

Timestamp:

Feb 16, 2007 2:35:03 PM (6 years ago)

Author:

thomascube <thomas@…>

Branches:

master, HEAD, courier-fix, dev-browser-capabilities, pdo, release-0.6, release-0.7, release-0.8

Children:

191667e

Parents:

1012ea3

Message:

Better input checking on GET and POST vars

Location:

program

Files:

• include/main.inc (modified) (1 diff)
• steps/mail/folders.inc (modified) (2 diffs)
• steps/mail/func.inc (modified) (3 diffs)
• steps/mail/list.inc (modified) (1 diff)
• steps/mail/mark.inc (modified) (1 diff)
• steps/mail/move_del.inc (modified) (4 diffs)
• steps/mail/show.inc (modified) (1 diff)
• steps/settings/delete_identity.inc (modified) (1 diff)
• steps/settings/manage_folders.inc (modified) (3 diffs)

program/include/main.inc

@@ -1690 +1690 @@
   {
   $attrib = array();
-  preg_match_all('/\s*([-_a-z]+)=["]([^"]+)["]?/i', stripslashes($str), $regs, PREG_SET_ORDER);
+  preg_match_all('/\s*([-_a-z]+)=(["\'])([^"]+)\2/Ui', stripslashes($str), $regs, PREG_SET_ORDER);
 
   // convert attributes to an associative array (name => value)
   if ($regs)
     foreach ($regs as $attr)
-      $attrib[strtolower($attr[1])] = $attr[2];
+      $attrib[strtolower($attr[1])] = $attr[3];
 
   return $attrib;

program/steps/mail/folders.inc

@@ -26 +26 @@
 if ($_action=='expunge')
   {
-  $success = $IMAP->expunge($_GET['_mbox']);
+  $success = $IMAP->expunge(get_input_value('_mbox', RCUBE_INPUT_GET));
 
   // reload message list if current mailbox  
-  if ($success && $_GET['_reload'])
+  if ($success && !empty($_GET['_reload']))
     {
     rcube_remote_response('this.message_list.clear();', TRUE);
@@ -42 +42 @@
 else if ($_action=='purge')
   {
-  $success = $IMAP->clear_mailbox($_GET['_mbox']);
+  $success = $IMAP->clear_mailbox(get_input_value('_mbox', RCUBE_INPUT_GET));
   
-  if ($success && $_GET['_reload'])
+  if ($success && !empty($_GET['_reload']))
     {
     $commands = "this.message_list.clear();\n";

program/steps/mail/func.inc

@@ -31 +31 @@
 
 // set imap properties and session vars
-if (strlen($mbox = get_input_value('_mbox', RCUBE_INPUT_GET)))
+if ($mbox = get_input_value('_mbox', RCUBE_INPUT_GPC))
   {
   $IMAP->set_mailbox($mbox);
@@ -37 +37 @@
   }
 
-if (strlen($_GET['_page']))
-  {
-  $IMAP->set_page($_GET['_page']);
-  $_SESSION['page'] = $_GET['_page'];
+if (!empty($_GET['_page']))
+  {
+  $IMAP->set_page((int)$_GET['_page']);
+  $_SESSION['page'] = (int)$_GET['_page'];
   }
 
@@ -60 +60 @@
 // define url for getting message parts
 if (strlen($_GET['_uid']))
-  $GET_URL = sprintf('%s&_action=get&_mbox=%s&_uid=%d', $COMM_PATH, $IMAP->get_mailbox_name(), $_GET['_uid']);
+  $GET_URL = sprintf('%s&_action=get&_mbox=%s&_uid=%d', $COMM_PATH, $IMAP->get_mailbox_name(), get_input_value('_uid', RCUBE_INPUT_GET));
 
 

program/steps/mail/list.inc

@@ -23 +23 @@
 $OUTPUT_TYPE = 'js';
 
-$sort = isset($_GET['_sort']) ? $_GET['_sort'] : false;
-
 // is there a sort type for this request?
-if ($sort)
+if ($sort = get_input_value('_sort', RCUBE_INPUT_GET))
   {
   // yes, so set the sort vars

program/steps/mail/mark.inc

@@ -26 +26 @@
                      'unread' => 'UNSEEN');
 
-if ($_GET['_uid'] && $_GET['_flag'])
+if (($uids = get_input_value('_uid', RCUBE_INPUT_GET)) && ($flag = get_input_value('_flag', RCUBE_INPUT_GET)))
   {
-  $flag = $a_flags_map[$_GET['_flag']] ? $a_flags_map[$_GET['_flag']] : strtoupper($_GET['_flag']);
-  $marked = $IMAP->set_flag($_GET['_uid'], $flag);
+  $flag = $a_flags_map[$flag] ? $a_flags_map[$flag] : strtoupper($flag);
+  $marked = $IMAP->set_flag($uids, $flag);
   if ($marked != -1)
     {

program/steps/mail/move_del.inc

@@ -23 +23 @@
 
 // move messages
-if ($_action=='moveto' && $_GET['_uid'] && $_GET['_target_mbox'])
+if ($_action=='moveto' && !empty($_GET['_uid']) && !empty($_GET['_target_mbox']))
   {
-  $count = sizeof(explode(',', $_GET['_uid']));
-  $moved = $IMAP->move_message($_GET['_uid'], $_GET['_target_mbox'], $_GET['_mbox']);
+  $count = sizeof(explode(',', ($uids = get_input_value('_uid', RCUBE_INPUT_GET))));
+  $target = get_input_value('_target_mbox', RCUBE_INPUT_GET);
+  $moved = $IMAP->move_message($uids, $target, get_input_value('_mbox', RCUBE_INPUT_GET));
   
   if (!$moved)
@@ -39 +40 @@
 
 // delete messages 
-else if ($_action=='delete' && $_GET['_uid'])
+else if ($_action=='delete' && !empty($_GET['_uid']))
   {
-  $count = sizeof(explode(',', $_GET['_uid']));
-  $del = $IMAP->delete_message($_GET['_uid'], $_GET['_mbox']);
+  $count = sizeof(explode(',', ($uids = get_input_value('_uid', RCUBE_INPUT_GET))));
+  $del = $IMAP->delete_message($uids, get_input_value('_mbox', RCUBE_INPUT_GET));
   
   if (!$del)
@@ -61 +62 @@
 
 // refresh saved seach set after moving some messages
-if (($search_request = $_GET['_search']) && $IMAP->search_set)
+if (($search_request = get_input_value('_search', RCUBE_INPUT_GPC)) && $IMAP->search_set)
   $_SESSION['search'][$search_request] = $IMAP->refresh_search();
 
@@ -76 +77 @@
 $commands .= sprintf("this.set_unread_count('%s', %d);\n", $mbox, $IMAP->messagecount($mbox, 'UNSEEN'));
 
-if ($_action=='moveto')
-  $commands .= sprintf("this.set_unread_count('%s', %d);\n", $_GET['_target_mbox'], $IMAP->messagecount($_GET['_target_mbox'], 'UNSEEN'));
+if ($_action=='moveto' && $target)
+  $commands .= sprintf("this.set_unread_count('%s', %d);\n", $target, $IMAP->messagecount($target, 'UNSEEN'));
 
 $commands .= sprintf("this.set_quota('%s');\n", $IMAP->get_quota()); 

program/steps/mail/show.inc

@@ -65 +65 @@
   // mark message as read
   if (!$MESSAGE['headers']->seen && $_action != 'preview')
-    $IMAP->set_flag($_GET['_uid'], 'SEEN');
+    $IMAP->set_flag($MESSAGE['UID'], 'SEEN');
 
   // give message uid to the client

program/steps/settings/delete_identity.inc

@@ -20 +20 @@
 */
 
-$REMOTE_REQUEST = $_GET['_remote'] ? TRUE : FALSE;
-
-if ($_GET['_iid'] && preg_match('/^[0-9]+(,[0-9]+)*$/',$_GET['_iid']))
+if (($ids = get_input_value('_iid', RCUBE_INPUT_GET)) && preg_match('/^[0-9]+(,[0-9]+)*$/', $ids))
   {
   $DB->query("UPDATE ".get_table_name('identities')."
               SET    del=1
               WHERE  user_id=?
-              AND    identity_id IN (".$_GET['_iid'].")",
+              AND    identity_id IN (".$ids.")",
               $_SESSION['user_id']);
 

program/steps/settings/manage_folders.inc

@@ -27 +27 @@
 if ($_action=='subscribe')
   {
-  if (strlen($_GET['_mboxes']))
-    $IMAP->subscribe(array($_GET['_mboxes']));
+  if ($mboxes = get_input_value('_mboxes', RCUBE_INPUT_GET))
+    $IMAP->subscribe(array($mboxes));
 
   if ($REMOTE_REQUEST)
@@ -37 +37 @@
 else if ($_action=='unsubscribe')
   {
-  if (strlen($_GET['_mboxes']))
-    $IMAP->unsubscribe(array($_GET['_mboxes']));
+  if ($mboxes = get_input_value('_mboxes', RCUBE_INPUT_GET))
+    $IMAP->unsubscribe(array($mboxes));
 
   if ($REMOTE_REQUEST)
@@ -96 +96 @@
 else if ($_action=='delete-folder')
   {
-  if (!empty($_GET['_mboxes']))
-    $deleted = $IMAP->delete_mailbox(array(get_input_value('_mboxes', RCUBE_INPUT_GET)));
+  if (get_input_value('_mboxes', RCUBE_INPUT_GET))
+    $deleted = $IMAP->delete_mailbox(array($mboxes));
 
   if ($REMOTE_REQUEST && $deleted)