Secure bin scripts by requiring a valid session and replace preg_replace(/../e) with preg_replace_callback

git-svn-id: https://svn.roundcube.net/trunk@2187 208e9e7b-5314-0410-a742-e7e81cd9613c

1 files changed, 12 insertions, 4 deletions

diff --git a/roundcubemail/bin/html2text.php b/roundcubemail/bin/html2text.php
index 3839f5d34..82a4044f8 100644
--- a/roundcubemail/bin/html2text.php
+++ b/roundcubemail/bin/html2text.php
@@ -20,11 +20,19 @@
 */
 
 define('INSTALL_PATH', realpath(dirname(__FILE__) . '/..') . '/');
-require INSTALL_PATH.'program/include/iniset.php';
+require INSTALL_PATH . 'program/include/iniset.php';
 
-$converter = new html2text($HTTP_RAW_POST_DATA);
+$RCMAIL = rcmail::get_instance();
 
-header('Content-Type: text/plain; charset=UTF-8');
-print trim($converter->get_text());
+if (!empty($RCMAIL->user->ID)) {
+  $converter = new html2text($HTTP_RAW_POST_DATA);
+
+  header('Content-Type: text/plain; charset=UTF-8');
+  print trim($converter->get_text());
+}
+else {
+  header("HTTP/1.0 403 Forbidden");
+  echo "Requires a valid user session";
+}
 
 ?>