diff options
| author | thomascube <thomas@roundcube.net> | 2008-12-24 14:19:27 +0000 |
|---|---|---|
| committer | thomascube <thomas@roundcube.net> | 2008-12-24 14:19:27 +0000 |
| commit | 1608f432826a41e035ee7ddb0dd409bbcf559b43 (patch) | |
| tree | 6133278a5f2e3a3e146734530a283cdfe9188b0b /bin/modcss.php | |
| parent | 4e0419b9cb984249b823e9484a2d63eb74fd156c (diff) | |
Secure bin scripts by requiring a valid session and replace preg_replace(/../e) with preg_replace_callback
Diffstat (limited to 'bin/modcss.php')
| -rw-r--r-- | bin/modcss.php | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/bin/modcss.php b/bin/modcss.php index 08da36707..d0a3cc934 100644 --- a/bin/modcss.php +++ b/bin/modcss.php @@ -20,10 +20,12 @@ */ define('INSTALL_PATH', realpath(dirname(__FILE__) . '/..') . '/'); -require INSTALL_PATH.'program/include/iniset.php'; +require INSTALL_PATH . 'program/include/iniset.php'; + +$RCMAIL = rcmail::get_instance(); $source = ""; -if ($url = preg_replace('/[^a-z0-9.-_\?\$&=%]/i', '', $_GET['u'])) +if (!empty($RCMAIL->user->ID) && ($url = preg_replace('/[^a-z0-9.-_\?\$&=%]/i', '', $_GET['u']))) { $a_uri = parse_url($url); $port = $a_uri['port'] ? $a_uri['port'] : 80; @@ -59,7 +61,9 @@ if (!empty($source)) header("Content-Type: text/css"); echo rcmail_mod_css_styles($source, preg_replace('/[^a-z0-9]/i', '', $_GET['c']), $url); } -else +else { header("HTTP/1.0 404 Not Found"); + echo "Requires a valid user session and source url"; +} ?> |