From 681ba6fc3c296cd6cd11050531b8f4e785141786 Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Tue, 16 Dec 2014 13:28:48 +0100 Subject: Improve system security by using optional special URL with security token Allows to define separate server/path for image/js/css files Fix bugs where CSRF attacks were still possible on some requests --- plugins/acl/acl.js | 27 ++++++++++++++-------- plugins/acl/acl.php | 12 +++++----- plugins/legacy_browser/js/iehacks.js | 2 +- .../lib/Roundcube/rcube_sieve_engine.php | 10 ++++---- 4 files changed, 30 insertions(+), 21 deletions(-) (limited to 'plugins') diff --git a/plugins/acl/acl.js b/plugins/acl/acl.js index e59ac72a2..14634534e 100644 --- a/plugins/acl/acl.js +++ b/plugins/acl/acl.js @@ -58,8 +58,11 @@ rcube_webmail.prototype.acl_delete = function() var users = this.acl_get_usernames(); if (users && users.length && confirm(this.get_label('acl.deleteconfirm'))) { - this.http_request('settings/plugin.acl', '_act=delete&_user='+urlencode(users.join(',')) - + '&_mbox='+urlencode(this.env.mailbox), + this.http_post('settings/plugin.acl', { + _act: 'delete', + _user: users.join(','), + _mbox: this.env.mailbox + }, this.set_busy(true, 'acl.deleting')); } } @@ -67,7 +70,7 @@ rcube_webmail.prototype.acl_delete = function() // Save ACL data rcube_webmail.prototype.acl_save = function() { - var user = $('#acluser', this.acl_form).val(), rights = '', type; + var data, type, rights = '', user = $('#acluser', this.acl_form).val(); $((this.env.acl_advanced ? '#advancedrights :checkbox' : '#simplerights :checkbox'), this.acl_form).map(function() { if (this.checked) @@ -88,12 +91,18 @@ rcube_webmail.prototype.acl_save = function() return; } - this.http_request('settings/plugin.acl', '_act=save' - + '&_user='+urlencode(user) - + '&_acl=' +rights - + '&_mbox='+urlencode(this.env.mailbox) - + (this.acl_id ? '&_old='+this.acl_id : ''), - this.set_busy(true, 'acl.saving')); + data = { + _act: 'save', + _user: user, + _acl: rights, + _mbox: this.env.mailbox + } + + if (this.acl_id) { + data._old = this.acl_id; + } + + this.http_post('settings/plugin.acl', data, this.set_busy(true, 'acl.saving')); } // Cancel/Hide form diff --git a/plugins/acl/acl.php b/plugins/acl/acl.php index 349f7e518..35a92bb1c 100644 --- a/plugins/acl/acl.php +++ b/plugins/acl/acl.php @@ -454,10 +454,10 @@ class acl extends rcube_plugin */ private function action_save() { - $mbox = trim(rcube_utils::get_input_value('_mbox', rcube_utils::INPUT_GPC, true)); // UTF7-IMAP - $user = trim(rcube_utils::get_input_value('_user', rcube_utils::INPUT_GPC)); - $acl = trim(rcube_utils::get_input_value('_acl', rcube_utils::INPUT_GPC)); - $oldid = trim(rcube_utils::get_input_value('_old', rcube_utils::INPUT_GPC)); + $mbox = trim(rcube_utils::get_input_value('_mbox', rcube_utils::INPUT_POST, true)); // UTF7-IMAP + $user = trim(rcube_utils::get_input_value('_user', rcube_utils::INPUT_POST)); + $acl = trim(rcube_utils::get_input_value('_acl', rcube_utils::INPUT_POST)); + $oldid = trim(rcube_utils::get_input_value('_old', rcube_utils::INPUT_POST)); $acl = array_intersect(str_split($acl), $this->rights_supported()); $users = $oldid ? array($user) : explode(',', $user); @@ -510,8 +510,8 @@ class acl extends rcube_plugin */ private function action_delete() { - $mbox = trim(rcube_utils::get_input_value('_mbox', rcube_utils::INPUT_GPC, true)); //UTF7-IMAP - $user = trim(rcube_utils::get_input_value('_user', rcube_utils::INPUT_GPC)); + $mbox = trim(rcube_utils::get_input_value('_mbox', rcube_utils::INPUT_POST, true)); //UTF7-IMAP + $user = trim(rcube_utils::get_input_value('_user', rcube_utils::INPUT_POST)); $user = explode(',', $user); diff --git a/plugins/legacy_browser/js/iehacks.js b/plugins/legacy_browser/js/iehacks.js index 8f88e6f57..105b7dabc 100644 --- a/plugins/legacy_browser/js/iehacks.js +++ b/plugins/legacy_browser/js/iehacks.js @@ -102,7 +102,7 @@ rcube_webmail.prototype.get_input_selection = function(obj) rcube_webmail.prototype.async_upload_form_frame = function(name) { document.body.insertAdjacentHTML('BeforeEnd', ''); + + ' src="' + rcmail.assets_path('program/resources/blank.gif') + '" style="width:0; height:0; visibility:hidden">'); return $('iframe[name="' + name + '"]'); }; diff --git a/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php b/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php index 8d0dca4d0..25016c878 100644 --- a/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php +++ b/plugins/managesieve/lib/Roundcube/rcube_sieve_engine.php @@ -349,7 +349,7 @@ class rcube_sieve_engine } } else if ($action == 'setact' && !$error) { - $script_name = rcube_utils::get_input_value('_set', rcube_utils::INPUT_GPC, true); + $script_name = rcube_utils::get_input_value('_set', rcube_utils::INPUT_POST, true); $result = $this->activate_script($script_name); $kep14 = $this->rc->config->get('managesieve_kolab_master'); @@ -363,7 +363,7 @@ class rcube_sieve_engine } } else if ($action == 'deact' && !$error) { - $script_name = rcube_utils::get_input_value('_set', rcube_utils::INPUT_GPC, true); + $script_name = rcube_utils::get_input_value('_set', rcube_utils::INPUT_POST, true); $result = $this->deactivate_script($script_name); if ($result === true) { @@ -376,7 +376,7 @@ class rcube_sieve_engine } } else if ($action == 'setdel' && !$error) { - $script_name = rcube_utils::get_input_value('_set', rcube_utils::INPUT_GPC, true); + $script_name = rcube_utils::get_input_value('_set', rcube_utils::INPUT_POST, true); $result = $this->remove_script($script_name); if ($result === true) { @@ -419,14 +419,14 @@ class rcube_sieve_engine $this->rc->output->command('managesieve_updatelist', 'list', array('list' => $result)); } else if ($action == 'ruleadd') { - $rid = rcube_utils::get_input_value('_rid', rcube_utils::INPUT_GPC); + $rid = rcube_utils::get_input_value('_rid', rcube_utils::INPUT_POST); $id = $this->genid(); $content = $this->rule_div($fid, $id, false); $this->rc->output->command('managesieve_rulefill', $content, $id, $rid); } else if ($action == 'actionadd') { - $aid = rcube_utils::get_input_value('_aid', rcube_utils::INPUT_GPC); + $aid = rcube_utils::get_input_value('_aid', rcube_utils::INPUT_POST); $id = $this->genid(); $content = $this->action_div($fid, $id, false); -- cgit v1.2.3