Prevent from endless loops in render_page hook

2 files changed, 22 insertions, 1 deletions

diff --git a/program/include/rcube_plugin_api.php b/program/include/rcube_plugin_api.php
index 381b36ff8..b05758a3f 100644
--- a/program/include/rcube_plugin_api.php
+++ b/program/include/rcube_plugin_api.php
@@ -39,7 +39,8 @@ class rcube_plugin_api
   private $objectsmap = array();
   private $template_contents = array();
   
-  private  $required_plugins = array('filesystem_attachments');
+  private $required_plugins = array('filesystem_attachments');
+  private $active_hook = false;
 
   /**
    * This implements the 'singleton' design pattern
@@ -179,6 +180,7 @@ class rcube_plugin_api
   public function exec_hook($hook, $args = array())
   {
     $args += array('abort' => false);
+    $this->active_hook = $hook;
     
     foreach ((array)$this->handlers[$hook] as $callback) {
       $ret = call_user_func($callback, $args);
@@ -189,6 +191,7 @@ class rcube_plugin_api
         break;
     }
     
+    $this->active_hook = false;
     return $args;
   }
 
@@ -257,6 +260,19 @@ class rcube_plugin_api
     }
   }
   
+  
+  /**
+   * Check if a plugin hook is currently processing.
+   * Mainly used to prevent loops and recursion.
+   *
+   * @param string Hook to check (optional)
+   * @return boolean True if any/the given hook is currently processed, otherwise false
+   */
+  public function is_processing($hook = null)
+  {
+    return $this->active_hook && (!$hook || $this->active_hook == $hook);
+  }
+  
   /**
    * Include a plugin script file in the current HTML page
    */
diff --git a/program/include/rcube_template.php b/program/include/rcube_template.php
index c4db040d8..382508099 100755
--- a/program/include/rcube_template.php
+++ b/program/include/rcube_template.php
@@ -287,6 +287,11 @@ class rcube_template extends rcube_html_page
     public function send($templ = null, $exit = true)
     {
         if ($templ != 'iframe') {
+            // prevent from endless loops
+            if ($this->app->plugins->is_processing('render_page')) {
+                raise_error(array('code' => 505, 'type' => 'php', 'message' => 'Recursion alert: ignoring output->send()'), true, false);
+                return;
+            }
             $this->parse($templ, false);
         }
         else {