diff options
| -rw-r--r-- | CHANGELOG | 1 | ||||
| -rw-r--r-- | program/include/rcube_json_output.php | 14 | ||||
| -rwxr-xr-x | program/include/rcube_template.php | 13 |
3 files changed, 19 insertions, 9 deletions
@@ -1,6 +1,7 @@ CHANGELOG Roundcube Webmail =========================== +- Fix XSS vulnerability in UI messages (#1488030) - Fix identities "reply-to" and "bcc" fields have a bogus value when left empty (#1487943) - Fix issue which cases IMAP disconnection when encrypt() method was used (#1487900) - Fix some CSS issues in Settings for Internet Explorer diff --git a/program/include/rcube_json_output.php b/program/include/rcube_json_output.php index cd6b289b2..f9fe38d62 100644 --- a/program/include/rcube_json_output.php +++ b/program/include/rcube_json_output.php @@ -169,12 +169,16 @@ class rcube_json_output public function show_message($message, $type='notice', $vars=null, $override=true) { if ($override || !$this->message) { + if (rcube_label_exists($message)) { + if (!empty($vars)) + $vars = array_map('Q', $vars); + $msgtext = rcube_label(array('name' => $message, 'vars' => $vars)); + } + else + $msgtext = $message; + $this->message = $message; - $this->command( - 'display_message', - rcube_label(array('name' => $message, 'vars' => $vars)), - $type - ); + $this->command('display_message', $msgtext, $type, $timeout * 1000); } } diff --git a/program/include/rcube_template.php b/program/include/rcube_template.php index 5e0f4c14f..9bd9b7a71 100755 --- a/program/include/rcube_template.php +++ b/program/include/rcube_template.php @@ -249,11 +249,16 @@ class rcube_template extends rcube_html_page public function show_message($message, $type='notice', $vars=null, $override=true) { if ($override || !$this->message) { + if (rcube_label_exists($message)) { + if (!empty($vars)) + $vars = array_map('Q', $vars); + $msgtext = rcube_label(array('name' => $message, 'vars' => $vars)); + } + else + $msgtext = $message; + $this->message = $message; - $this->command( - 'display_message', - rcube_label(array('name' => $message, 'vars' => $vars)), - $type); + $this->command('display_message', $msgtext, $type, $timeout * 1000); } } |