From 334475a50bcc97a8c326aadff0dcbb61fad40a4f Mon Sep 17 00:00:00 2001 From: Till Krüss Date: Mon, 10 Feb 2014 21:32:06 +0530 Subject: prevent unwanted code execution via CURLOPT_POSTFIELDS --- plugins/password/drivers/domainfactory.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/plugins/password/drivers/domainfactory.php b/plugins/password/drivers/domainfactory.php index e253faa49..6e1219869 100644 --- a/plugins/password/drivers/domainfactory.php +++ b/plugins/password/drivers/domainfactory.php @@ -29,11 +29,11 @@ class rcube_domainfactory_password CURLOPT_RETURNTRANSFER => true, CURLOPT_URL => 'https://ssl.df.eu/chmail.php', CURLOPT_POST => true, - CURLOPT_POSTFIELDS => array( + CURLOPT_POSTFIELDS => http_build_query(array( 'login' => $rcmail->user->get_username(), 'pwd' => $curpass, 'action' => 'change' - ) + )) )); if ($result = curl_exec($ch)) { -- cgit v1.2.3