From 54be5ccb50be664ca4cc30fab6fb84e7be8e223e Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Fri, 8 Jun 2012 09:22:49 +0200
Subject: Fix XSS vulnerability in message subject handling using Larry skin
 (#1488519)

---
 program/steps/mail/func.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'program/steps/mail/func.inc')

diff --git a/program/steps/mail/func.inc b/program/steps/mail/func.inc
index 1e5dbda19..7417c6ba3 100644
--- a/program/steps/mail/func.inc
+++ b/program/steps/mail/func.inc
@@ -947,7 +947,7 @@ function rcmail_message_headers($attrib, $headers=NULL)
 
   // single header value is requested
   if (!empty($attrib['valueof']))
-    return Q($plugin['output'][$attrib['valueof']]['value'], ($hkey == 'subject' ? 'strict' : 'show'));
+    return Q($plugin['output'][$attrib['valueof']]['value'], ($attrib['valueof'] == 'subject' ? 'strict' : 'show'));
 
   // compose html table
   $table = new html_table(array('cols' => 2));
-- 
cgit v1.2.3