Whitelist configuration options (user preferences) that can be changed using save-pref command

Conflicts:

	program/lib/Roundcube/rcube_plugin.php
	program/lib/Roundcube/rcube_plugin_api.php

4 files changed, 33 insertions, 5 deletions

diff --git a/CHANGELOG b/CHANGELOG
index eb3948c81..436d035ba 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,10 @@
 CHANGELOG Roundcube Webmail
 ===========================
 
+- Fix security issue in save-pref command
+
+RELEASE 0.8.5
+-------------
 - Fix #countcontrols issue in IE<=8 when text is very long (#1488890)
 - Fix unwanted horizontal scrollbar in message preview header (#1488866)
 - Add workaround for IE<=8 bug where Content-Disposition:inline was ignored (#1488844)
diff --git a/program/include/rcube_plugin.php b/program/include/rcube_plugin.php
index e7115cbec..de0aabbe3 100644
--- a/program/include/rcube_plugin.php
+++ b/program/include/rcube_plugin.php
@@ -61,6 +61,14 @@ abstract class rcube_plugin
    */
   public $noframe = false;
 
+  /**
+   * A list of config option names that can be modified
+   * by the user via user interface (with save-pref command)
+   *
+   * @var array
+   */
+  public $allowed_prefs;
+
   protected $home;
   protected $urlbase;
   private $mytask;
diff --git a/program/include/rcube_plugin_api.php b/program/include/rcube_plugin_api.php
index be12f11b5..61bab3ce9 100644
--- a/program/include/rcube_plugin_api.php
+++ b/program/include/rcube_plugin_api.php
@@ -35,6 +35,7 @@ class rcube_plugin_api
   public $url = 'plugins/';
   public $output;
   public $config;
+  public $allowed_prefs = array();
   
   public $handlers = array();
   private $plugins = array();
@@ -188,6 +189,9 @@ class rcube_plugin_api
             $plugin->init();
             $this->plugins[$plugin_name] = $plugin;
           }
+          if (!empty($plugin->allowed_prefs)) {
+            $this->allowed_prefs = array_merge($this->allowed_prefs, $plugin->allowed_prefs);
+          }
           return true;
         }
       }
diff --git a/program/steps/utils/save_pref.inc b/program/steps/utils/save_pref.inc
index 2c60f6d4e..3c3cfa0ff 100644
--- a/program/steps/utils/save_pref.inc
+++ b/program/steps/utils/save_pref.inc
@@ -5,7 +5,7 @@
  | program/steps/utils/save_pref.inc                                     |
  |                                                                       |
  | This file is part of the Roundcube Webmail client                     |
- | Copyright (C) 2005-2010, The Roundcube Dev Team                       |
+ | Copyright (C) 2005-2013, The Roundcube Dev Team                       |
  |                                                                       |
  | Licensed under the GNU General Public License version 3 or            |
  | any later version with exceptions for skins & plugins.                |
@@ -17,13 +17,26 @@
  +-----------------------------------------------------------------------+
  | Author: Aleksander Machniak <alec@alec.pl>                            |
  +-----------------------------------------------------------------------+
-
- $Id$
-
 */
 
 $name = get_input_value('_name', RCUBE_INPUT_POST);
 $value = get_input_value('_value', RCUBE_INPUT_POST);
+$whitelist = array(
+    'preview_pane',
+    'list_cols',
+    'collapsed_folders',
+    'collapsed_abooks',
+);
+
+if (!in_array($name, array_merge($whitelist, $RCMAIL->plugins->allowed_prefs))) {
+    raise_error(array('code' => 500, 'type' => 'php',
+        'file' => __FILE__, 'line' => __LINE__,
+        'message' => sprintf("Hack attempt detected (user: %s)", $_SESSION['username'])),
+        true, false);
+
+    $OUTPUT->reset();
+    $OUTPUT->send();
+}
 
 // save preference value
 $RCMAIL->user->save_prefs(array($name => $value));
@@ -45,4 +58,3 @@ if ($sessname = get_input_value('_session', RCUBE_INPUT_POST)) {
 $OUTPUT->reset();
 $OUTPUT->send();
 
-