summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorthomascube <thomas@roundcube.net>2011-08-12 19:39:39 +0000
committerthomascube <thomas@roundcube.net>2011-08-12 19:39:39 +0000
commit58fc995728352b466f166a67281b11f6db191f31 (patch)
treed552dd826c8be4d77583a2e2b700b573f5318984
parent41bdcf2daae7d78d5c070b011e5f9aa7ce5f6ca2 (diff)
Backport XSS vulnerability fix to 0.5 branch
-rw-r--r--CHANGELOG1
-rw-r--r--program/include/rcube_json_output.php14
-rwxr-xr-xprogram/include/rcube_template.php13
3 files changed, 19 insertions, 9 deletions
diff --git a/CHANGELOG b/CHANGELOG
index 0e163fd79..c56a199ad 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,7 @@
CHANGELOG Roundcube Webmail
===========================
+- Fix XSS vulnerability in UI messages (#1488030)
- Fix identities "reply-to" and "bcc" fields have a bogus value when left empty (#1487943)
- Fix issue which cases IMAP disconnection when encrypt() method was used (#1487900)
- Fix some CSS issues in Settings for Internet Explorer
diff --git a/program/include/rcube_json_output.php b/program/include/rcube_json_output.php
index cd6b289b2..f9fe38d62 100644
--- a/program/include/rcube_json_output.php
+++ b/program/include/rcube_json_output.php
@@ -169,12 +169,16 @@ class rcube_json_output
public function show_message($message, $type='notice', $vars=null, $override=true)
{
if ($override || !$this->message) {
+ if (rcube_label_exists($message)) {
+ if (!empty($vars))
+ $vars = array_map('Q', $vars);
+ $msgtext = rcube_label(array('name' => $message, 'vars' => $vars));
+ }
+ else
+ $msgtext = $message;
+
$this->message = $message;
- $this->command(
- 'display_message',
- rcube_label(array('name' => $message, 'vars' => $vars)),
- $type
- );
+ $this->command('display_message', $msgtext, $type, $timeout * 1000);
}
}
diff --git a/program/include/rcube_template.php b/program/include/rcube_template.php
index 5e0f4c14f..9bd9b7a71 100755
--- a/program/include/rcube_template.php
+++ b/program/include/rcube_template.php
@@ -249,11 +249,16 @@ class rcube_template extends rcube_html_page
public function show_message($message, $type='notice', $vars=null, $override=true)
{
if ($override || !$this->message) {
+ if (rcube_label_exists($message)) {
+ if (!empty($vars))
+ $vars = array_map('Q', $vars);
+ $msgtext = rcube_label(array('name' => $message, 'vars' => $vars));
+ }
+ else
+ $msgtext = $message;
+
$this->message = $message;
- $this->command(
- 'display_message',
- rcube_label(array('name' => $message, 'vars' => $vars)),
- $type);
+ $this->command('display_message', $msgtext, $type, $timeout * 1000);
}
}