Skip to content
Permalink
Browse files
Fix security issue in contact photo handling (#1490379)
  • Loading branch information
alecpl committed May 7, 2015
1 parent 3aba794 commit 6ccd4c54bcc4cb77365defabe8bbe7d10b2620d4
Showing with 1 addition and 6 deletions.
  1. +1 −0 CHANGELOG
  2. +0 −5 program/steps/addressbook/photo.inc
  3. +0 −1 program/steps/mail/show.inc
@@ -9,6 +9,7 @@ CHANGELOG Roundcube Webmail
- Fix duplicate entry on timezones list in rcube_config::timezone_name_from_abbr() (#1490293)
- Fix handling of %-encoded entities in mailto: URLs (#1490346)
- Fix bug where messages count was not updated after message move/delete with skip_deleted=false (#1490372)
- Fix security issue in contact photo handling (#1490379)

RELEASE 1.0.5
-------------
@@ -80,11 +80,6 @@ if (strlen($data) < 1024 && filter_var($data, FILTER_VALIDATE_URL)) {
$RCMAIL->output->redirect($data);
}

// deliver alt image
if (!$data && ($alt_img = rcube_utils::get_input_value('_alt', rcube_utils::INPUT_GPC)) && is_file($alt_img)) {
$data = file_get_contents($alt_img);
}

// cache for one day if requested by email
if (!$cid && $email) {
$RCMAIL->output->future_expire_header(86400);
@@ -343,7 +343,6 @@ function rcmail_message_contactphoto($attrib)
'_task' => 'addressbook',
'_action' => 'photo',
'_email' => $MESSAGE->sender['mailto'],
'_alt' => $placeholder,
));

$attrib['onerror'] = "this.src = '" . ($placeholder ? $placeholder : 'program/resources/blank.gif') . "'";

0 comments on commit 6ccd4c5

Please sign in to comment.