- Fix handling of attachments when Content-Disposition is not inline nor attachment (#1487051)

git-svn-id: https://svn.roundcube.net/trunk@4116 208e9e7b-5314-0410-a742-e7e81cd9613c

1 files changed, 3 insertions, 1 deletions

diff --git a/roundcubemail/program/include/rcube_message.php b/roundcubemail/program/include/rcube_message.php
index ec1359c86..89d65eb1e 100644
--- a/roundcubemail/program/include/rcube_message.php
+++ b/roundcubemail/program/include/rcube_message.php
@@ -448,7 +448,9 @@ class rcube_message
                 }
                 // part is a file/attachment
                 else if (preg_match('/^(inline|attach)/', $mail_part->disposition) ||
-                    $mail_part->headers['content-id'] || (empty($mail_part->disposition) && $mail_part->filename)
+                    $mail_part->headers['content-id'] ||
+                    ($mail_part->filename &&
+                        (empty($mail_part->disposition) || preg_match('/^[a-z0-9!#$&.+^_-]+$/i', $mail_part->disposition)))
                 ) {
                     // skip apple resource forks
                     if ($message_ctype_secondary == 'appledouble' && $secondary_type == 'applefile')