Mirrors/roundcubemail
2
0
Fork 0
mirror of https://github.com/roundcube/roundcubemail.git synced 2026-03-21 15:26:58 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix check_request() bypass in places using get_uids() [CVE-2018-9846] (#6238)

Browse Source
This commit is contained in:
Aleksander Machniak
2018-04-09 09:07:27 +02:00
parent 915e50af9f
commit 8e543f843e
9 changed files with 24 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
program/include/rcmail.php
View File

@@ -2402,16 +2402,17 @@ class rcmail extends rcube
* @param string $uids UID value to decode
* @param string $mbox Default mailbox value (if not encoded in UIDs)
* @param bool $is_multifolder Will be set to True if multi-folder request
* @param int $mode Request mode. Default: rcube_utils::INPUT_GPC.
*
* @return array List of message UIDs per folder
*/
public static function get_uids($uids = null, $mbox = null, &$is_multifolder = false)
public static function get_uids($uids = null, $mbox = null, &$is_multifolder = false, $mode = null)
{
// message UID (or comma-separated list of IDs) is provided in
// the form of <ID>-<MBOX>[,<ID>-<MBOX>]*
$_uid = $uids ?: rcube_utils::get_input_value('_uid', rcube_utils::INPUT_GPC);
$_mbox = $mbox ?: (string) rcube_utils::get_input_value('_mbox', rcube_utils::INPUT_GPC);
$_uid = $uids ?: rcube_utils::get_input_value('_uid', $mode ?: rcube_utils::INPUT_GPC);
$_mbox = $mbox ?: (string) rcube_utils::get_input_value('_mbox', $mode ?: rcube_utils::INPUT_GPC);
// already a hash array
if (is_array($_uid) && !isset($_uid[0])) {
@@ -2430,8 +2431,9 @@ class rcmail extends rcube
}
}
else {
if (is_string($_uid))
if (is_string($_uid)) {
$_uid = explode(',', $_uid);
}
// create a per-folder UIDs array
foreach ((array)$_uid as $uid) {
@@ -2446,7 +2448,7 @@ class rcmail extends rcube
if ($uid == '*') {
$result[$mbox] = $uid;
}
else {
else if (preg_match('/^[0-9:.]+$/', $uid)) {
$result[$mbox][] = $uid;
}
}