public nobgit read

NobMail

Based on mailcow: dockerized

Languages

Repository composition by tracked source files.

PHP

PHP 49% JavaScript 35% HTML 9% CSS 4% Shell 2% Python 1% Lua 0% Perl 0% Ruby 0% SCSS 0%

Create file Wiki Documentation

Clone

https://nobgit.com/orgs/nobgit/nobmail.git

ssh://[email protected]:2222/orgs/nobgit/nobmail.git

Commit

[Web] Fix potential XSS in autodiscover-json.php

8e736ba9

andryyy <[email protected]> 4 years, 11 months ago

data/web/autodiscover-json.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Diff

diff --git a/data/web/autodiscover-json.php b/data/web/autodiscover-json.php
index e1749b75..2fa96990 100644
--- a/data/web/autodiscover-json.php
+++ b/data/web/autodiscover-json.php
@@ -16,6 +16,6 @@ elseif (strtolower($_GET['Protocol']) == 'autodiscoverv1') {
 }
 else {
   http_response_code(400);
-  echo '{"ErrorCode":"InvalidProtocol","ErrorMessage":"The given protocol value \u0027' . $_GET['Protocol'] . '\u0027 is invalid. Supported values are \u0027ActiveSync,AutodiscoverV1\u0027"}';
+  echo '{"ErrorCode":"InvalidProtocol","ErrorMessage":"The given protocol value \u0027' . preg_replace("/[^\da-z]/i", '', $_GET['Protocol']) . '\u0027 is invalid. Supported values are \u0027ActiveSync,AutodiscoverV1\u0027"}';
 }
 ?>