Fix bug where 'skins_allowed' option didn't enforce user skin preference (#7080)

CHANGELOG

@@ -23,6 +23,7 @@ CHANGELOG Roundcube Webmail
 - Fix bug where HTML reply could add an empty line with extra indentation above the original message (#7088)
 - Fix matching multiple X-Forwarded-For addresses with 'proxy_whitelist' (#7107)
 - Fix so displayed maximum attachment size depends also on 'max_message_size' (#7105)
+- Fix bug where 'skins_allowed' option didn't enforce user skin preference (#7080)
 
 RELEASE 1.4.1
 -------------

config/defaults.inc.php

@@ -1081,10 +1081,11 @@ $config['contact_search_name'] = '{name} <{email}>';
 // Use this charset as fallback for message decoding
 $config['default_charset'] = 'ISO-8859-1';
 
-// skin name: folder from skins/
+// Skin name: folder from skins/
 $config['skin'] = 'elastic';
 
-// limit skins available/shown in the settings section
+// Limit skins available for the user.
+// Note: When not empty, it should include the default skin set in 'skin' option.
 $config['skins_allowed'] = array();
 
 // Enables using standard browser windows (that can be handled as tabs)

program/include/rcmail_output_html.php

@@ -312,6 +312,12 @@ EOF;
             return false;
         }
 
+        $skins_allowed = $this->config->get('skins_allowed');
+
+        if (!empty($skins_allowed) && !in_array($skin, (array) $skins_allowed)) {
+            return false;
+        }
+
         $path = RCUBE_INSTALL_PATH . 'skins/';
 
         return !empty($skin) && is_dir($path . $skin) && is_readable($path . $skin);

program/lib/Roundcube/rcube_config.php

@@ -455,6 +455,12 @@ class rcube_config
             $prefs['skin'] = self::DEFAULT_SKIN;
         }
 
+        $skins_allowed = $this->get('skins_allowed');
+
+        if (!empty($prefs['skin']) && !empty($skins_allowed) && !in_array($prefs['skin'], (array) $skins_allowed)) {
+            unset($prefs['skin']);
+        }
+
         $this->userprefs = $prefs;
         $this->prop      = array_merge($this->prop, $prefs);
     }