Fix vulnerability in handling _session argument of utils/save-prefs (#1489382)

Conflicts:

	CHANGELOG
	program/lib/Roundcube/rcube_plugin_api.php
	program/steps/utils/save_pref.inc

1 files changed, 4 insertions, 3 deletions

diff --git a/program/include/rcube_plugin_api.php b/program/include/rcube_plugin_api.php
index 61bab3ce9..a1e634a4f 100644
--- a/program/include/rcube_plugin_api.php
+++ b/program/include/rcube_plugin_api.php
@@ -30,13 +30,14 @@
 class rcube_plugin_api
 {
   static private $instance;
-  
+
   public $dir;
   public $url = 'plugins/';
   public $output;
   public $config;
-  public $allowed_prefs = array();
-  
+  public $allowed_prefs         = array();
+  public $allowed_session_prefs = array();
+
   public $handlers = array();
   private $plugins = array();
   private $tasks = array();