X-Git-Url: https://vcs.fsf.org/?a=blobdiff_plain;f=src%2Foptions_identities.php;h=e8cc6aed8ccff679782f21646f107dc0b007cc4b;hb=adc3ea746a7853859d1e17cf60550992ccba011a;hp=087cc0e50556752d4f2b05a869514fba5700cc54;hpb=ebd2391cb0c5e3049870f90fa8a8b28707e9571a;p=squirrelmail.git diff --git a/src/options_identities.php b/src/options_identities.php index 087cc0e5..e8cc6aed 100644 --- a/src/options_identities.php +++ b/src/options_identities.php @@ -5,7 +5,7 @@ * * Display Identities Options * - * @copyright © 1999-2007 The SquirrelMail Project Team + * @copyright 1999-2020 The SquirrelMail Project Team * @license http://opensource.org/licenses/gpl-license.php GNU Public License * @version $Id$ * @package squirrelmail @@ -23,6 +23,7 @@ require('../include/init.php'); /* SquirrelMail required files. */ require_once(SM_PATH . 'functions/identity.php'); +require_once(SM_PATH . 'functions/forms.php'); /* make sure that page is not available when $edit_identity is false */ if (!$edit_identity) { @@ -37,10 +38,14 @@ if (!sqgetGlobalVar('identities', $identities, SQ_SESSION)) { sqgetGlobalVar('newidentities', $newidentities, SQ_POST); sqgetGlobalVar('smaction', $smaction, SQ_POST); sqgetGlobalVar('return', $return, SQ_POST); +sqgetGlobalVar('smtoken', $submitted_token, SQ_POST, ''); // First lets see if there are any actions to perform // if (!empty($smaction) && is_array($smaction)) { + // first do a security check + sm_validate_security_token($submitted_token, -1, TRUE); + $doaction = ''; $identid = 0; @@ -75,10 +80,10 @@ foreach ($identities as $key=>$ident) { $a['Title'] = $key==0 ? _("Default Identity") : sprintf(_("Alternate Identity %d"), $key); $a['New'] = false; $a['Default'] = $key==0; - $a['FullName'] = htmlspecialchars($ident['full_name']); - $a['Email'] = htmlspecialchars($ident['email_address']); - $a['ReplyTo'] = htmlspecialchars($ident['reply_to']); - $a['Signature'] = htmlspecialchars($ident['signature']); + $a['FullName'] = sm_encode_html_special_chars($ident['full_name']); + $a['Email'] = sm_encode_html_special_chars($ident['email_address']); + $a['ReplyTo'] = sm_encode_html_special_chars($ident['reply_to']); + $a['Signature'] = sm_encode_html_special_chars($ident['signature']); $i[$key] = $a; } @@ -93,7 +98,8 @@ $a['Signature'] = ''; $i[count($i)] = $a; //FIXME: NO HTML IN THE CORE -echo '