From 9d0239afa62c0b640a0a6e42bff80968edd85027 Mon Sep 17 00:00:00 2001 From: cigamit Date: Fri, 14 Jan 2005 06:16:22 +0000 Subject: [PATCH] Added hook for Preferences Backend to resolve potential file inclusions git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@8647 7612ce4b-ef26-0410-bec9-ea0150e637f0 --- ChangeLog | 2 ++ doc/plugin.txt | 1 + functions/prefs.php | 4 +++- 3 files changed, 6 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 927054ec..0b0f5ea4 100644 --- a/ChangeLog +++ b/ChangeLog @@ -175,6 +175,8 @@ Version 1.5.1 -- CVS links, and return to message page that originally called from. - Max upload file size now correctly handles a '-1' value, meaning unlimited (#1094569). + - Security: Added hook for Preferences Backend to resolve potential + file inclusions Version 1.5.0 -------------------- diff --git a/doc/plugin.txt b/doc/plugin.txt index 8f4d76d7..ddbfc21a 100644 --- a/doc/plugin.txt +++ b/doc/plugin.txt @@ -294,6 +294,7 @@ but may be out of date soon thereafter. You never know. ;-) decode_body functions/mime.php hook_func generic_header functions/page_header.php do_hook menuline functions/page_header.php do_hook + prefs_backend functions/prefs.php hook_func loading_prefs include/load_prefs.php do_hook addrbook_html_search_below src/addrbook_search_html.php do_hook addressbook_bottom src/addressbook.php do_hook diff --git a/functions/prefs.php b/functions/prefs.php index 92f6f43d..fb1c0c38 100644 --- a/functions/prefs.php +++ b/functions/prefs.php @@ -14,6 +14,7 @@ /** Include global.php */ require_once(SM_PATH . 'functions/global.php'); +require_once(SM_PATH . 'functions/plugin.php'); sqgetGlobalVar('prefs_cache', $prefs_cache, SQ_SESSION ); sqgetGlobalVar('prefs_are_cached', $prefs_are_cached, SQ_SESSION ); @@ -26,7 +27,8 @@ if ( !sqsession_is_registered('prefs_are_cached') || $prefs_cache = array(); } -if (isset($prefs_backend) && file_exists(SM_PATH . $prefs_backend)) { +$prefs_backend = do_hook_function('prefs_backend'); +if (isset($prefs_backend) && !empty($prefs_backend) && file_exists(SM_PATH . $prefs_backend)) { require_once(SM_PATH . $prefs_backend); } elseif (isset($prefs_dsn) && !empty($prefs_dsn)) { require_once(SM_PATH . 'functions/db_prefs.php'); -- 2.25.1