Fix XSS holes in generic options inputs, XSS hole in the SquirrelSpell plugin, and...

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@14120 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/doc/ChangeLog b/doc/ChangeLog
index a9c1710d01c6d729239e2cf34f5d7f74b71ed91a..64fbb7891e10d9a4362fa4d75c84e31b567ccc24 100644 (file)
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -362,6 +362,9 @@ Version 1.5.2 - SVN
     to config_local.php.
   - Added clickjacking protection (thanks to Asbjorn Thorsen and Geir Hansen
     for bringing this to our attention). [CVE-2010-4554]
+  - Fixed XSS holes in generic options inputs, XSS hole in the SquirrelSpell
+    plugin, and added anti-CSRF protection to the empty trash feature (thanks
+    to Nicholas Carlini for finding all these issues). [CVE-2010-4555]
 
 Version 1.5.1 (branched on 2006-02-12)
 --------------------------------------

diff --git a/functions/options.php b/functions/options.php
index 0935ebf80debac47483467c66ce8f6b88c04c954..a09f3a2e41840e2ec3917780c912b3ab21303f37 100644 (file)
--- a/functions/options.php
+++ b/functions/options.php
@@ -831,6 +831,21 @@ function save_option($option) {
         return;
     }
 
+    // if the widget is a selection list, make sure the new
+    // value is actually in the selection list and is not an
+    // injection attack
+    //
+    if ($option->type == SMOPT_TYPE_STRLIST
+     && !array_key_exists($option->new_value, $option->possible_values))
+        return;
+
+
+    // all other widgets except TEXTAREAs should never be allowed to have newlines
+    //
+    else if ($option->type != SMOPT_TYPE_TEXTAREA)
+        $option->new_value = str_replace(array("\r", "\n"), '', $option->new_value);
+
+
     global $data_dir;
 
     // edit lists: first add new elements to list, then

diff --git a/plugins/squirrelspell/modules/check_me.mod b/plugins/squirrelspell/modules/check_me.mod
index b15b21a99c2e3a5f5887ade10b68597eb4ae1985..d5cbd2ad7b3e1da07dc908e5f33a7534f8742d9f 100644 (file)
--- a/plugins/squirrelspell/modules/check_me.mod
+++ b/plugins/squirrelspell/modules/check_me.mod
@@ -183,7 +183,7 @@ if ($errors){
   for ($i=0; $i<sizeof($sqspell_lines); $i++){
     // use addcslashes for compatibility with magic_quotes_sybase
     $extrajs.= "sqspell_lines[$i] = \""
-      . chop(addcslashes($sqspell_lines[$i], "'\"\\\x0")) . "\";\n";
+      . chop(addcslashes($sqspell_lines[$i], ">'\"\\\x0")) . "\";\n";
   }
   $extrajs.= "\n\n";
 

diff --git a/src/empty_trash.php b/src/empty_trash.php
index a71dd7414a1631c87a143490ead7335d0b7535fc..2c52f8898663e56bd633beb56540b64bf3c84145 100644 (file)
--- a/src/empty_trash.php
+++ b/src/empty_trash.php
@@ -30,6 +30,10 @@ sqgetGlobalVar('delimiter', $delimiter, SQ_SESSION);
 
 /* finished globals */
 
+// first do a security check
+sqgetGlobalVar('smtoken', $submitted_token, SQ_GET, '');
+sm_validate_security_token($submitted_token, 3600, TRUE);
+
 $imap_stream = sqimap_login($username, false, $imapServerAddress, $imapPort, 0);
 
 $mailbox = $trash_folder;

diff --git a/templates/default/left_main.tpl b/templates/default/left_main.tpl
index 162883711c540bb339e20a0fbbab69b9c19ea55a..a64a5188c728cf3c02e92c2eecfccc0627130c9f 100644 (file)
--- a/templates/default/left_main.tpl
+++ b/templates/default/left_main.tpl
@@ -196,7 +196,7 @@ function buildMailboxTree ($box, $settings, $icon_theme_path, $indent_factor=0)
                 $end .= '&nbsp;<small>('.$unseen_str.')</small>';
             }
             $end .= "\n<small>" .
-                    '&nbsp;&nbsp;[<a href="empty_trash.php">'. _("Purge").'</a>]' .
+                    '&nbsp;&nbsp;[<a href="empty_trash.php?smtoken=' . sm_generate_security_token() . '">'. _("Purge").'</a>]' .
                     '</small>';
         }
     } else {

diff --git a/templates/default_advanced/left_main.tpl b/templates/default_advanced/left_main.tpl
index 061530c8a328d0071693e9389d0d857a0f76718c..ef129fa52db0ba918f91c97c1cd46d2f9edac5ae 100644 (file)
--- a/templates/default_advanced/left_main.tpl
+++ b/templates/default_advanced/left_main.tpl
@@ -305,7 +305,7 @@ extract($t);
 <?php
 if ($settings['messageRecyclingEnabled']) {
     echo '<br />';
-    echo '<a href="empty_trash.php"';
+    echo '<a href="empty_trash.php?smtoken=' . sm_generate_security_token() . '"';
     if ($accesskey_folders_purge_trash != 'NONE')
         echo ' accesskey="' . $accesskey_folders_purge_trash . '"';
     echo '>' . _("Purge Trash") . '</a>';