Fix check_request() bypass in plugins using get_uids() (#6238)

[CVE-2018-9846]

CHANGELOG

@@ -3,6 +3,7 @@ CHANGELOG Roundcube Webmail
 
 - Don't ignore (global) userlogins/sendmail logs in per_user_logging mode
 - Fix security issue in remote content blocking on HTML image and style tags (#6178)
+- Fix check_request() bypass in places using get_uids() [CVE-2018-9846] (#6238)
 - Fix possible IMAP command injection vulnerability [CVE-2018-9846] (#6229)
 
 RELEASE 1.1.10

plugins/archive/archive.php

@@ -122,8 +122,10 @@ class archive extends rcube_plugin
       $index = $storage->index(null, rcmail_sort_column(), rcmail_sort_order());
       $messageset = array($current_mbox => $index->get());
     }
-    else {
+    else if (!empty($uids)) {
-      $messageset = rcmail::get_uids();
+      $messageset = rcmail::get_uids($uids, $current_mbox);
+    } else {
+      $messageset = array();
     }
 
     foreach ($messageset as $mbox => $uids) {

plugins/managesieve/managesieve.php

@@ -191,7 +191,7 @@ class managesieve extends rcube_plugin
     {
         // handle fetching email headers for the new filter form
         if ($uid = rcube_utils::get_input_value('_uid', rcube_utils::INPUT_POST)) {
-            $uids    = rcmail::get_uids();
+            $uids    = rcmail::get_uids($uid);
             $mailbox = key($uids);
             $message = new rcube_message($uids[$mailbox][0], $mailbox);
             $headers = $this->parse_headers($message->headers);

plugins/markasjunk/markasjunk.php

@@ -58,11 +58,14 @@ class markasjunk extends rcube_plugin
 
     $rcmail  = rcmail::get_instance();
     $storage = $rcmail->get_storage();
+    $uids    = rcube_utils::get_input_value('_uid', rcube_utils::INPUT_POST);
 
-    foreach (rcmail::get_uids() as $mbox => $uids) {
+    if (!empty($uids)) {
+      foreach (rcmail::get_uids($uids) as $mbox => $uids) {
         $storage->unset_flag($uids, 'NONJUNK', $mbox);
         $storage->set_flag($uids, 'JUNK', $mbox);
       }
+    }
 
     if (($junk_mbox = $rcmail->config->get('junk_mbox'))) {
       $rcmail->output->command('move_messages', $junk_mbox);