Browse Source

Fix part 1 for XSS issue... call page like this:

  src/compose.php?mailbox="><script>alert('Nuts!');</script>

Because this file is included in other pages, it could affect others too.
jangliss 21 years ago
parent
commit
2f22395f11
1 changed files with 2 additions and 2 deletions
  1. 2 2
      functions/page_header.php

+ 2 - 2
functions/page_header.php

@@ -277,8 +277,8 @@ function displayPageHeader($color, $mailbox, $xtra='', $session=false) {
 
 
     echo "<body text=\"$color[8]\" bgcolor=\"$color[4]\" link=\"$color[7]\" vlink=\"$color[7]\" alink=\"$color[7]\" $onload>\n\n";
     echo "<body text=\"$color[8]\" bgcolor=\"$color[4]\" link=\"$color[7]\" vlink=\"$color[7]\" alink=\"$color[7]\" $onload>\n\n";
     /** Here is the header and wrapping table **/
     /** Here is the header and wrapping table **/
-    $shortBoxName = imap_utf7_decode_local(
-		      readShortMailboxName($mailbox, $delimiter));
+    $shortBoxName = htmlspecialchars(imap_utf7_decode_local(
+		      readShortMailboxName($mailbox, $delimiter)));
     if ( $shortBoxName == 'INBOX' ) {
     if ( $shortBoxName == 'INBOX' ) {
         $shortBoxName = _("INBOX");
         $shortBoxName = _("INBOX");
     }
     }