Fix serveral cross site scripting bugs found by Martijn Brinkers and

ourselves. Part 1/2, patch to magicHTML will follow. This is CAN-2005-1769.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@9610 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/plugins/filters/options.php b/plugins/filters/options.php
index c4e974511d02e9c64b40c66eb7b98a96b6ca44db..bc3cb1b0b65aa77fca5cfb6912e6887cb799ed81 100644 (file)
--- a/plugins/filters/options.php
+++ b/plugins/filters/options.php
@@ -187,7 +187,7 @@ if (sqgetGlobalVar('filter_submit',$filter_submit,SQ_POST)) {
                 html_tag( 'td', '', 'left' ) .
                     '<input type="text" size="32" name="filter_what" value="';
         if (isset($filters[$theid]['what'])) {
-            echo $filters[$theid]['what'];
+            echo htmlspecialchars($filters[$theid]['what']);
         }
         echo '" />'.
                 '</td>'.
@@ -260,4 +260,4 @@ if (sqgetGlobalVar('filter_submit',$filter_submit,SQ_POST)) {
             ) ,
         'center', '', 'width="80%" border="0" cellpadding="2" cellspacing="0"' );
     echo '</body></html>';
-?>
\ No newline at end of file
+?>

diff --git a/plugins/filters/spamoptions.php b/plugins/filters/spamoptions.php
index c2ab0b0ca18a7863e996ef9240545d51ad73b051..2db4dff215fc8086be5e92112731f2967088d333 100644 (file)
--- a/plugins/filters/spamoptions.php
+++ b/plugins/filters/spamoptions.php
@@ -179,7 +179,7 @@ if (isset($action) && $action == 'spam') {
     echo html_tag( 'p', '', 'center' ) .
          '[<a href="spamoptions.php?action=spam">' . _("Edit") . '</a>]' .
          ' - [<a href="../../src/options.php">' . _("Done") . '</a>]</center><br /><br />';
-    printf( _("Spam is sent to %s."), ($filters_spam_folder?'<b>'.imap_utf7_decode_local($filters_spam_folder).'</b>':'[<i>'._("not set yet").'</i>]' ) );
+    printf( _("Spam is sent to %s."), ($filters_spam_folder?'<b>'.htmlspecialchars(imap_utf7_decode_local($filters_spam_folder)).'</b>':'[<i>'._("not set yet").'</i>]' ) );
     echo '<br />';
     printf( _("Spam scan is limited to %s."), '<b>' . ( ($filters_spam_scan == 'new')?_("Unread messages only"):_("All messages") ) . '</b>' );
     echo '</p>'.
@@ -216,4 +216,4 @@ if (isset($action) && $action == 'spam') {
     echo '</table>';
 }
 ?>
-</body></html>
\ No newline at end of file
+</body></html>