Whitelist configuration options (user preferences) that can be changed using save-pref command

program/lib/Roundcube/rcube_plugin.php

@@ -60,6 +60,14 @@ abstract class rcube_plugin
      */
     public $noframe = false;
 
+    /**
+     * A list of config option names that can be modified
+     * by the user via user interface (with save-prefs command)
+     *
+     * @var array
+     */
+    public $allowed_prefs;
+
     protected $home;
     protected $urlbase;
     private $mytask;

program/lib/Roundcube/rcube_plugin_api.php

@@ -36,6 +36,7 @@ class rcube_plugin_api
     public $task = '';
     public $output;
     public $handlers = array();
+    public $allowed_prefs = array();
 
     protected $plugins = array();
     protected $tasks = array();
@@ -202,6 +203,11 @@ class rcube_plugin_api
                         $plugin->init();
                         $this->plugins[$plugin_name] = $plugin;
                     }
+
+                    if (!empty($plugin->allowed_prefs)) {
+                        $this->allowed_prefs = array_merge($this->allowed_prefs, $plugin->allowed_prefs);
+                    }
+
                     return true;
                 }
             }

program/steps/utils/save_pref.inc

@@ -21,6 +21,22 @@
 
 $name = get_input_value('_name', RCUBE_INPUT_POST);
 $value = get_input_value('_value', RCUBE_INPUT_POST);
+$whitelist = array(
+    'preview_pane',
+    'list_cols',
+    'collapsed_folders',
+    'collapsed_abooks',
+);
+
+if (!in_array($name, array_merge($whitelist, $RCMAIL->plugins->allowed_prefs))) {
+    raise_error(array('code' => 500, 'type' => 'php',
+        'file' => __FILE__, 'line' => __LINE__,
+        'message' => sprintf("Hack attempt detected (user: %s)", $RCMAIL->get_user_name())),
+        true, false);
+
+    $OUTPUT->reset();
+    $OUTPUT->send();
+}
 
 // save preference value
 $RCMAIL->user->save_prefs(array($name => $value));