Re: Fw: [Full-disclosure] XSS in roundcube.com and users of it

I think the problem is in index.php Here is a quick fix:

After line 93, add

//Line 93 $_task = get_input_value('_task', RCUBE_INPUT_GPC);

//sanitize $_task if (!preg_match('/[a-z]+/i',$_task,$task_sanitized)) { $_task = ''; } else { $_task = $task_sanitized[0]; }

It only allows tasks that are made of letters. Correct the problem on my installation.

Another solution (don't know which is better):

Use in_array($_task, $MAIN_TASKS) and defaults if not inside the array. I think we should default to '' there because the default task is set after this step.

Problem is on line 128 $COMM_PATH = sprintf('./?_task=%s', $_task); $COMM_PATH is then output to the user, hence the alert box.

Aurélien