3 files changed, 28 insertions, 0 deletions
diff --git a/program/steps/utils/save_pref.inc b/program/steps/utils/save_pref.inc
index b550ad7ef..7def8733d 100644
--- a/program/steps/utils/save_pref.inc
+++ b/program/steps/utils/save_pref.inc
@@ -21,6 +21,22 @@
 
 $name = get_input_value('_name', RCUBE_INPUT_POST);
 $value = get_input_value('_value', RCUBE_INPUT_POST);
+$whitelist = array(
+    'preview_pane',
+    'list_cols',
+    'collapsed_folders',
+    'collapsed_abooks',
+);
+
+if (!in_array($name, array_merge($whitelist, $RCMAIL->plugins->allowed_prefs))) {
+    raise_error(array('code' => 500, 'type' => 'php',
+        'file' => __FILE__, 'line' => __LINE__,
+        'message' => sprintf("Hack attempt detected (user: %s)", $RCMAIL->get_user_name())),
+        true, false);
+
+    $OUTPUT->reset();
+    $OUTPUT->send();
+}
 
 // save preference value
 $RCMAIL->user->save_prefs(array($name => $value));
diff --git a/program/steps/utils/spell.inc b/program/steps/utils/spell.inc
index a0dd35d27..38e4ca285 100644
--- a/program/steps/utils/spell.inc
+++ b/program/steps/utils/spell.inc
@@ -42,6 +42,13 @@ else {
     $result = $spellchecker->get_xml();
 }
 
+if ($err = $spellchecker->error()) {
+    rcube::raise_error(array('code' => 500, 'type' => 'php',
+        'file' => __FILE__, 'line' => __LINE__,
+        'message' => sprintf("Spell check engine error: " . $err)),
+        true, false);
+}
+
 // set response length
 header("Content-Length: " . strlen($result));
 
diff --git a/program/steps/utils/spell_html.inc b/program/steps/utils/spell_html.inc
index 861e4ba48..96b41e230 100644
--- a/program/steps/utils/spell_html.inc
+++ b/program/steps/utils/spell_html.inc
@@ -46,6 +46,11 @@ else if ($request['method'] == 'learnWord') {
 }
 
 if ($error = $spellchecker->error()) {
+    rcube::raise_error(array('code' => 500, 'type' => 'php',
+        'file' => __FILE__, 'line' => __LINE__,
+        'message' => sprintf("Spell check engine error: " . $error)),
+        true, false);
+
     echo '{"error":{"errstr":"' . addslashes($error) . '","errfile":"","errline":null,"errcontext":"","level":"FATAL"}}';
     exit;
 }