From b3ce7915610a6d272cc38ecd2a8b61e04ee4aeae Mon Sep 17 00:00:00 2001
From: thomascube <thomas@roundcube.net>
Date: Fri, 16 Feb 2007 19:35:03 +0000
Subject: Better input checking on GET and POST vars

---
 program/steps/settings/delete_identity.inc |  6 ++----
 program/steps/settings/manage_folders.inc  | 12 ++++++------
 2 files changed, 8 insertions(+), 10 deletions(-)

(limited to 'program/steps/settings')

diff --git a/program/steps/settings/delete_identity.inc b/program/steps/settings/delete_identity.inc
index 24bf99c43..560a2b10b 100644
--- a/program/steps/settings/delete_identity.inc
+++ b/program/steps/settings/delete_identity.inc
@@ -19,14 +19,12 @@
 
 */
 
-$REMOTE_REQUEST = $_GET['_remote'] ? TRUE : FALSE;
-
-if ($_GET['_iid'] && preg_match('/^[0-9]+(,[0-9]+)*$/',$_GET['_iid']))
+if (($ids = get_input_value('_iid', RCUBE_INPUT_GET)) && preg_match('/^[0-9]+(,[0-9]+)*$/', $ids))
   {
   $DB->query("UPDATE ".get_table_name('identities')."
               SET    del=1
               WHERE  user_id=?
-              AND    identity_id IN (".$_GET['_iid'].")",
+              AND    identity_id IN (".$ids.")",
               $_SESSION['user_id']);
 
   $count = $DB->affected_rows();
diff --git a/program/steps/settings/manage_folders.inc b/program/steps/settings/manage_folders.inc
index 8abd2c3b6..4759dd295 100644
--- a/program/steps/settings/manage_folders.inc
+++ b/program/steps/settings/manage_folders.inc
@@ -26,8 +26,8 @@ rcmail_imap_init(TRUE);
 // subscribe to one or more mailboxes
 if ($_action=='subscribe')
   {
-  if (strlen($_GET['_mboxes']))
-    $IMAP->subscribe(array($_GET['_mboxes']));
+  if ($mboxes = get_input_value('_mboxes', RCUBE_INPUT_GET))
+    $IMAP->subscribe(array($mboxes));
 
   if ($REMOTE_REQUEST)
     rcube_remote_response('// subscribed');
@@ -36,8 +36,8 @@ if ($_action=='subscribe')
 // unsubscribe one or more mailboxes
 else if ($_action=='unsubscribe')
   {
-  if (strlen($_GET['_mboxes']))
-    $IMAP->unsubscribe(array($_GET['_mboxes']));
+  if ($mboxes = get_input_value('_mboxes', RCUBE_INPUT_GET))
+    $IMAP->unsubscribe(array($mboxes));
 
   if ($REMOTE_REQUEST)
     rcube_remote_response('// unsubscribed');
@@ -95,8 +95,8 @@ else if ($_action=='rename-folder')
 // delete an existing IMAP mailbox
 else if ($_action=='delete-folder')
   {
-  if (!empty($_GET['_mboxes']))
-    $deleted = $IMAP->delete_mailbox(array(get_input_value('_mboxes', RCUBE_INPUT_GET)));
+  if (get_input_value('_mboxes', RCUBE_INPUT_GET))
+    $deleted = $IMAP->delete_mailbox(array($mboxes));
 
   if ($REMOTE_REQUEST && $deleted)
     {
-- 
cgit v1.2.3