summaryrefslogtreecommitdiff
path: root/program
diff options
context:
space:
mode:
authorThomas Bruederli <thomas@roundcube.net>2013-03-27 17:05:54 +0100
committerThomas Bruederli <bruederli@kolabsys.com>2013-03-27 17:30:54 +0100
commit95ac3e217a4df8b14a2ab054dfb8032818c2bf72 (patch)
tree86e55fec8fae2fecd9b2e023bb282ebd972f023c /program
parent395b74051ce974ced8a5abe378f66e9bcf0c8e34 (diff)
Sanity check the file path for generic message footer before adding it
Diffstat (limited to 'program')
-rw-r--r--program/steps/mail/sendmail.inc39
1 files changed, 29 insertions, 10 deletions
diff --git a/program/steps/mail/sendmail.inc b/program/steps/mail/sendmail.inc
index b5d383422..9b11068f5 100644
--- a/program/steps/mail/sendmail.inc
+++ b/program/steps/mail/sendmail.inc
@@ -204,6 +204,33 @@ function rcmail_email_input_format($mailto, $count=false, $check=true)
}
+function rcmail_generic_message_footer($isHtml)
+{
+ global $CONFIG;
+
+ if ($isHtml && !empty($CONFIG['generic_message_footer_html'])) {
+ $file = $CONFIG['generic_message_footer_html'];
+ $html_footer = true;
+ }
+ else {
+ $file = $CONFIG['generic_message_footer'];
+ $html_footer = false;
+ }
+
+ if ($file && realpath($file)) {
+ // sanity check
+ if (!preg_match('/\.(php|ini|conf)$/', $file) && strpos($file, '/etc/') === false) {
+ $footer = file_get_contents($file);
+ if ($isHtml && !$html_footer)
+ $footer = '<pre>' . $footer . '</pre>';
+ return $footer;
+ }
+ }
+
+ return false;
+}
+
+
/****** compose message ********/
if (strlen($_POST['_draft_saveid']) > 3)
@@ -434,19 +461,11 @@ if (!$savedraft) {
}
// generic footer for all messages
- if ($isHtml && !empty($CONFIG['generic_message_footer_html'])) {
- $footer = file_get_contents(realpath($CONFIG['generic_message_footer_html']));
- $footer = rcube_charset_convert($footer, RCMAIL_CHARSET, $message_charset);
- }
- else if (!empty($CONFIG['generic_message_footer'])) {
- $footer = file_get_contents(realpath($CONFIG['generic_message_footer']));
+ if ($footer = rcmail_generic_message_footer($isHtml)) {
$footer = rcube_charset_convert($footer, RCMAIL_CHARSET, $message_charset);
- if ($isHtml)
- $footer = '<pre>'.$footer.'</pre>';
+ $message_body .= "\r\n" . $footer;
}
- if ($footer)
- $message_body .= "\r\n" . $footer;
if ($isHtml)
$message_body .= "\r\n</body></html>\r\n";
}