Fix so settings/upload.inc could not be used by plugins (#5694)

roundcube · Mar 17, 2017 · fa62496 · fa62496
1 parent cbd3562
commit fa62496
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 0 deletions.
diff --git a/CHANGELOG b/CHANGELOG
@@ -25,6 +25,7 @@ RELEASE 1.2.4
 - Add rewrite rule to disable access to /vendor/bin folder in .htaccess (#5630)
 - Fix bug where it was too easy accidentally move a folder when using the subscription checkbox (#5655)
 - Fix XSS issue in handling of a style tag inside of an svg element
+- Fix so settings/upload.inc could not be used by plugins (#5694)
 
 RELEASE 1.2.3
 -------------

diff --git a/program/steps/settings/upload.inc b/program/steps/settings/upload.inc
@@ -27,6 +27,11 @@ if (!empty($_GET['_progress'])) {
 $from = rcube_utils::get_input_value('_from', rcube_utils::INPUT_GET);
 $type = preg_replace('/(add|edit)-/', '', $from);
 
+// Plugins in Settings may use this file for some uploads (#5694)
+// Make sure it does not contain a dot, which is a special character
+// when using rcube_session::append() below
+$type = str_replace('.', '-', $type);
+
 if ($RCMAIL->action == 'upload-display') {
     $id = 'undefined';