- Fix XSS vulnerability in UI messages (#1488030)

git-svn-id: https://svn.roundcube.net/trunk@5037 208e9e7b-5314-0410-a742-e7e81cd9613c

2 files changed, 16 insertions, 2 deletions

diff --git a/roundcubemail/program/include/rcube_json_output.php b/roundcubemail/program/include/rcube_json_output.php
index 40a7b2a5e..ade9cc033 100644
--- a/roundcubemail/program/include/rcube_json_output.php
+++ b/roundcubemail/program/include/rcube_json_output.php
@@ -174,8 +174,15 @@ class rcube_json_output
     public function show_message($message, $type='notice', $vars=null, $override=true, $timeout=0)
     {
         if ($override || !$this->message) {
+            if (rcube_label_exists($message)) {
+                if (!empty($vars))
+                    $vars = array_map('Q', $vars);
+                $msgtext = rcube_label(array('name' => $message, 'vars' => $vars));
+            }
+            else
+                $msgtext = $message;
+
             $this->message = $message;
-            $msgtext = rcube_label_exists($message) ? rcube_label(array('name' => $message, 'vars' => $vars)) : $message;
             $this->command('display_message', $msgtext, $type, $timeout * 1000);
         }
     }
diff --git a/roundcubemail/program/include/rcube_template.php b/roundcubemail/program/include/rcube_template.php
index 6228e7659..b9a43d3f1 100755
--- a/roundcubemail/program/include/rcube_template.php
+++ b/roundcubemail/program/include/rcube_template.php
@@ -248,8 +248,15 @@ class rcube_template extends rcube_html_page
     public function show_message($message, $type='notice', $vars=null, $override=true, $timeout=0)
     {
         if ($override || !$this->message) {
+            if (rcube_label_exists($message)) {
+                if (!empty($vars))
+                    $vars = array_map('Q', $vars);
+                $msgtext = rcube_label(array('name' => $message, 'vars' => $vars));
+            }
+            else
+                $msgtext = $message;
+
             $this->message = $message;
-            $msgtext = rcube_label_exists($message) ? rcube_label(array('name' => $message, 'vars' => $vars)) : $message;
             $this->command('display_message', $msgtext, $type, $timeout * 1000);
         }
     }