diff options
| author | thomasb <thomasb@208e9e7b-5314-0410-a742-e7e81cd9613c> | 2006-11-22 11:42:37 +0000 |
|---|---|---|
| committer | thomasb <thomasb@208e9e7b-5314-0410-a742-e7e81cd9613c> | 2006-11-22 11:42:37 +0000 |
| commit | 8e8daf41abb1fb9863e482d8f4eae48abe60ca6b (patch) | |
| tree | d23d2ba913ddd549faacdd0b9f66de637fd68ddc | |
| parent | a84ebbddf66a55cff1f8631b08eef93a8a67a4b6 (diff) | |
Fixed XSS vulnerability (Bug #1484109)
git-svn-id: https://svn.roundcube.net/trunk@382 208e9e7b-5314-0410-a742-e7e81cd9613c
| -rw-r--r-- | roundcubemail/index.php | 15 | ||||
| -rw-r--r-- | roundcubemail/program/include/main.inc | 8 |
2 files changed, 14 insertions, 9 deletions
diff --git a/roundcubemail/index.php b/roundcubemail/index.php index 4e9dee1c7..4bf9d9487 100644 --- a/roundcubemail/index.php +++ b/roundcubemail/index.php @@ -2,7 +2,7 @@ /* +-----------------------------------------------------------------------+ | RoundCube Webmail IMAP Client | - | Version 0.1-20060907 | + | Version 0.1-20061122 | | | | Copyright (C) 2005-2006, RoundCube Dev. - Switzerland | | Licensed under the GNU GPL | @@ -40,7 +40,7 @@ */ -define('RCMAIL_VERSION', '0.1-20060907'); +define('RCMAIL_VERSION', '0.1-20061122'); // define global vars $CHARSET = 'UTF-8'; @@ -90,11 +90,12 @@ require_once('PEAR.php'); // catch some url/post parameters -$_task = get_input_value('_task', RCUBE_INPUT_GPC); -$_action = get_input_value('_action', RCUBE_INPUT_GPC); +$_task = strip_quotes(get_input_value('_task', RCUBE_INPUT_GPC)); +$_action = strip_quotes(get_input_value('_action', RCUBE_INPUT_GPC)); $_framed = (!empty($_GET['_framed']) || !empty($_POST['_framed'])); -if (empty($_task)) +// use main task if empty or invalid value +if (empty($_task) || !in_array($_task, $MAIN_TASKS)) $_task = 'mail'; if (!empty($_GET['_remote'])) @@ -372,9 +373,7 @@ if ($_task=='settings') // parse main template -// only allow these templates to be included -if (in_array($_task, $MAIN_TASKS)) - parse_template($_task); +parse_template($_task); // if we arrive here, something went wrong diff --git a/roundcubemail/program/include/main.inc b/roundcubemail/program/include/main.inc index da449c64c..55336fd30 100644 --- a/roundcubemail/program/include/main.inc +++ b/roundcubemail/program/include/main.inc @@ -1063,7 +1063,13 @@ function get_input_value($fname, $source, $allow_html=FALSE, $charset=NULL) return $value; } - +/** + * Remove single and double quotes from given string + */ +function strip_quotes($str) +{ + return preg_replace('/[\'"]/', '', $str); +} // ************** template parsing and gui functions ************** |