Skip to content
Permalink
Browse files Browse the repository at this point in the history
Fix security issue in contact photo handling (#1490379)
  • Loading branch information
alecpl committed May 7, 2015
1 parent bb21913 commit e84fafc
Show file tree
Hide file tree
Showing 2 changed files with 1 addition and 5 deletions.
1 change: 1 addition & 0 deletions CHANGELOG
Expand Up @@ -24,6 +24,7 @@ CHANGELOG Roundcube Webmail
- Fix mouseup event handling when dragging a list record (#1490359)
- Fix bug where preview_pane setting wasn't always saved into user preferences (#1490362)
- Fix bug where messages count was not updated after message move/delete with skip_deleted=false (#1490372)
- Fix security issue in contact photo handling (#1490379)

RELEASE 1.1.1
-------------
Expand Down
5 changes: 0 additions & 5 deletions program/steps/addressbook/photo.inc
Expand Up @@ -80,11 +80,6 @@ if (strlen($data) < 1024 && filter_var($data, FILTER_VALIDATE_URL)) {
$RCMAIL->output->redirect($data);
}

// deliver alt image
if (!$data && ($alt_img = rcube_utils::get_input_value('_alt', rcube_utils::INPUT_GPC)) && is_file($alt_img)) {
$data = file_get_contents($alt_img);
}

// cache for one day if requested by email
if (!$cid && $email) {
$RCMAIL->output->future_expire_header(86400);
Expand Down

0 comments on commit e84fafc

Please sign in to comment.