Fix vulnerability in handling of mail()'s 5th argument

CHANGELOG

@@ -1,6 +1,8 @@
 CHANGELOG Roundcube Webmail
 ===========================
 
+- Fix vulnerability in handling of mail()'s 5th argument
+
 RELEASE 1.1.6
 -------------
 - Searching in both contacts and groups when LDAP addressbook with group_filters option is used

program/lib/Roundcube/rcube.php

@@ -1749,7 +1749,7 @@ class rcube
                 if (filter_var(ini_get('safe_mode'), FILTER_VALIDATE_BOOLEAN))
                     $sent = mail($to, $subject, $msg_body, $header_str);
                 else
-                    $sent = mail($to, $subject, $msg_body, $header_str, "-f$from");
+                    $sent = mail($to, $subject, $msg_body, $header_str, '-f ' . escapeshellarg($from));
             }
         }