djmaze 099ee3b97e @ZaphodB fix(@security): S/MIME actions put the client's part id into IMAP FETCH as is ... DoSMimeDecryptMessage and DoSMimeVerifyMessage built BODY.PEEK[<partId>] (and [<partId>.MIME]) from the partId / sigPartId parameters without checking them, so a value could close the bracket or the line and add IMAP commands of its own. They run in the user's own IMAP session, so this is not cross-account, but nothing in that session should be steerable by a request parameter. Read both through smimePartIdParam(), which accepts only an IMAP section number (1, 1.2.10) or TEXT and refuses anything else. test/smime-partid.php checks valid ids pass and injection attempts, zero or leading-zero sections, lowercase and other section keywords are refused.		2026-10-27 22:50:28 +01:00
..
app	@ZaphodB fix(@security): S/MIME actions put the client's part id into IMAP FETCH as is	2026-10-27 22:50:28 +01:00
static	Resolve #1408	2024-01-29 11:25:42 +01:00
themes	Resolve #1775	2024-10-06 23:46:53 +02:00
cpanel.php	cPanel use extension login-cpanel instead of login-remote	2024-04-17 01:10:03 +02:00
imapsync.php	fixed typo in imapsync.php: was "RainLoop\API" instead of "RainLoop\Api"	2025-11-19 23:10:15 +01:00
include.php	Drop md5(file_get_contents(DATA.php)) because i think nobody used this undocumented feature	2024-08-11 12:39:34 +02:00
index.php	Rename basefolder 'rainloop' to 'snappymail'	2020-10-15 16:21:52 +02:00
setup.php	Prevent mkdir() error #1565	2024-04-28 14:50:08 +02:00