From c2e1ab4765ea69112791df3607faadf1bbf8b9c9 Mon Sep 17 00:00:00 2001 From: Thomas Bruederli Date: Wed, 1 May 2013 13:26:07 +0200 Subject: Escape user input values when used in eval() --- program/lib/Roundcube/rcube_ldap.php | 16 +++++++++------- 1 file changed, 9 insertions(+), 7 deletions(-) (limited to 'program/lib/Roundcube/rcube_ldap.php') diff --git a/program/lib/Roundcube/rcube_ldap.php b/program/lib/Roundcube/rcube_ldap.php index 47e96c32b..922c73568 100644 --- a/program/lib/Roundcube/rcube_ldap.php +++ b/program/lib/Roundcube/rcube_ldap.php @@ -1403,13 +1403,15 @@ class rcube_ldap extends rcube_addressbook foreach ((array)$this->prop['autovalues'] as $lf => $templ) { if (empty($attrs[$lf])) { - // replace {attr} placeholders with concrete attribute values - $templ = preg_replace('/\{\w+\}/', '', strtr($templ, $attrvals)); - - if (strpos($templ, '(') !== false) - $attrs[$lf] = eval("return ($templ);"); - else - $attrs[$lf] = $templ; + if (strpos($templ, '(') !== false) { + // replace {attr} placeholders with (escaped!) attribute values to be safely eval'd + $code = preg_replace('/\{\w+\}/', '', strtr($templ, array_map('addslashes', $attrvals))); + $attrs[$lf] = eval("return ($code);"); + } + else { + // replace {attr} placeholders with concrete attribute values + $attrs[$lf] = preg_replace('/\{\w+\}/', '', strtr($templ, $attrvals)); + } } } } -- cgit v1.2.3