diff options
| author | Aleksander Machniak <alec@alec.pl> | 2012-06-08 09:22:49 +0200 |
|---|---|---|
| committer | Aleksander Machniak <alec@alec.pl> | 2012-06-08 09:23:32 +0200 |
| commit | 54be5ccb50be664ca4cc30fab6fb84e7be8e223e (patch) | |
| tree | 855625839f39af12cf3e250c32ec72e81c92dc4f /program/steps/mail/func.inc | |
| parent | 8c188058cf9281251cbac5cda43ef833843fd51b (diff) | |
Fix XSS vulnerability in message subject handling using Larry skin (#1488519)
Diffstat (limited to 'program/steps/mail/func.inc')
| -rw-r--r-- | program/steps/mail/func.inc | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc index 1e5dbda19..7417c6ba3 100644 --- a/program/steps/mail/func.inc +++ b/program/steps/mail/func.inc @@ -947,7 +947,7 @@ function rcmail_message_headers($attrib, $headers=NULL) // single header value is requested if (!empty($attrib['valueof'])) - return Q($plugin['output'][$attrib['valueof']]['value'], ($hkey == 'subject' ? 'strict' : 'show')); + return Q($plugin['output'][$attrib['valueof']]['value'], ($attrib['valueof'] == 'subject' ? 'strict' : 'show')); // compose html table $table = new html_table(array('cols' => 2)); |