Fix security issue in contact photo handling (#1490379)

CHANGELOG

@@ -9,6 +9,7 @@ CHANGELOG Roundcube Webmail
 - Fix duplicate entry on timezones list in rcube_config::timezone_name_from_abbr() (#1490293)
 - Fix handling of %-encoded entities in mailto: URLs (#1490346)
 - Fix bug where messages count was not updated after message move/delete with skip_deleted=false (#1490372)
+- Fix security issue in contact photo handling (#1490379)
 
 RELEASE 1.0.5
 -------------

program/steps/addressbook/photo.inc

@@ -80,11 +80,6 @@ if (strlen($data) < 1024 && filter_var($data, FILTER_VALIDATE_URL)) {
     $RCMAIL->output->redirect($data);
 }
 
-// deliver alt image
-if (!$data && ($alt_img = rcube_utils::get_input_value('_alt', rcube_utils::INPUT_GPC)) && is_file($alt_img)) {
-    $data = file_get_contents($alt_img);
-}
-
 // cache for one day if requested by email
 if (!$cid && $email) {
     $RCMAIL->output->future_expire_header(86400);

program/steps/mail/show.inc

@@ -343,7 +343,6 @@ function rcmail_message_contactphoto($attrib)
             '_task'   => 'addressbook',
             '_action' => 'photo',
             '_email'  => $MESSAGE->sender['mailto'],
-            '_alt'    => $placeholder,
         ));
 
         $attrib['onerror'] = "this.src = '" . ($placeholder ? $placeholder : 'program/resources/blank.gif') . "'";