Fix POST parameter reflection in default_charset selector (#5768)

CHANGELOG

@@ -10,6 +10,7 @@ CHANGELOG Roundcube Webmail
 - Fix folders list sorting on Windows - if php-intl is available (#5732)
 - Fix addressbook searching by gender (#5757)
 - Fix prevention from using % and * characters in folder name (#5762)
+- Fix POST parameter reflection in default_charset selector (#5768)
 - Enigma: Fix compatibility with assets_dir
 - Managesieve: Skip redundant LISTSCRIPTS command
 

program/include/rcmail_output_html.php

@@ -2064,8 +2064,8 @@ EOF;
             'GB2312'       => 'GB2312 ('.$this->app->gettext('chinese').')',
         );
 
-        if (!empty($_POST['_charset'])) {
-            $set = $_POST['_charset'];
+        if ($post = rcube_utils::get_input_value('_charset', rcube_utils::INPUT_POST)) {
+            $set = $post;
         }
         else if (!empty($attrib['selected'])) {
             $set = $attrib['selected'];
@@ -2075,7 +2075,7 @@ EOF;
         }
 
         $set = strtoupper($set);
-        if (!isset($charsets[$set])) {
+        if (!isset($charsets[$set]) && preg_match('/^[A-Z0-9-]+$/', $set)) {
             $charsets[$set] = $set;
         }
 

program/steps/settings/save_prefs.inc

@@ -67,6 +67,10 @@ case 'mailview':
         'default_charset' => rcube_utils::get_input_value('_default_charset', rcube_utils::INPUT_POST),
     );
 
+    if ($a_user_prefs['default_charset'] && !preg_match('/^[a-zA-Z0-9-]+$/', $a_user_prefs['default_charset'])) {
+        $a_user_prefs['default_charset'] = $CONFIG['default_charset'];
+    }
+
     break;
 
 case 'compose':