patch a security hole in UW

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@941 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/src/right_main.php b/src/right_main.php
index 955faf64ae84274ace6a1c8a036924c84e2bdeef..6f4d2149b6cc0ba549fbb5223c24d56736873871 100644 (file)
--- a/src/right_main.php
+++ b/src/right_main.php
@@ -79,6 +79,11 @@
       $startMessage = 1;
    }
 
+   // compensate for the UW vulnerability
+   if ($imap_server_type == "uw" && strstr($mailbox, "../")) {
+      $mailbox = "INBOX";
+   }
+
    sqimap_mailbox_select($imapConnection, $mailbox);
    displayPageHeader($color, $mailbox);