Re: [RCD] zero day vulnerability (tested on v8.0 to 9.0)

On 03/28/2013 08:16 AM, Rosali wrote:

Do we need $allowed_prefs, if we are using the preferences_save hook, or do we need the definition if we are using rcmail::get_instance()->user->save_prefs(...), or is it needed for both?

None of these. Only if plugin uses save-pref request from javascript, e.g. rcmail.command('save-pref',....) or rcmail.save_pref(...) or rcmail.http_post('save-pref',...). It's because utils/save_pref.inc is the only place where we check this whitelist. User preferences saved by Settings/Preferences interface are validated in other places.

Will the patches be included in git branches? Will it be included in official downloads from sourceforge for 0.8.5 and 0.9-rc?

New releases are available.