From 10e5192a2b1bc90ec137f5e69d0aa072c1210d6d Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 22 Dec 2015 12:40:36 +0100
Subject: [PATCH] Fix path traversal vulnerability in setting a skin (#1490620)

---
 CHANGELOG                              |  1 +
 program/include/rcmail_output_html.php | 11 +++++++++++
 2 files changed, 12 insertions(+)

diff --git a/CHANGELOG b/CHANGELOG
index 3eabdb420..9cde93da7 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -5,6 +5,7 @@ CHANGELOG Roundcube Webmail
 - Fix regression in displaying contents of message/rfc822 parts (#1490606)
 - Fix handling of message/rfc822 attachments on replies and forwards (#1490607)
 - Fix PDF support detection in Firefox > 19 (#1490610)
+- Fix path traversal vulnerability in setting a skin (#1490620)
 
 RELEASE 1.2-beta
 ----------------
diff --git a/program/include/rcmail_output_html.php b/program/include/rcmail_output_html.php
index 9b75e9fee..f6020107d 100644
--- a/program/include/rcmail_output_html.php
+++ b/program/include/rcmail_output_html.php
@@ -224,6 +224,17 @@ EOF;
      */
     public function set_skin($skin)
     {
+        // Sanity check to prevent from path traversal vulnerability (#1490620)
+        if (strpos($skin, '/') !== false || strpos($skin, "\\") !== false) {
+            rcube::raise_error(array(
+                    'file'    => __FILE__,
+                    'line'    => __LINE__,
+                    'message' => 'Invalid skin name'
+                ), true, false);
+
+            return false;
+        }
+
         $valid = false;
         $path  = RCUBE_INSTALL_PATH . 'skins/';