Squirrelmail Security Fix

[liunx]

Squirrelmail has a security patch on its <a href="http://www.squirrelmail.org/" target="_blank">web site</a>, explained here:<br /><br /><!--quoteo--><div class='quotetop'>QUOTE</div><div class='quotemain'><!--quotec-->A small vulnerability exists in the decoding of certain headers which could allow for a remote user to exploit a cross site scripting vulnerability.<!--QuoteEnd--></div><!--QuoteEEnd-->It comes in the form of a diff file. Since I have limited access to my web server files, can I manually patch the file, by copying and pasting the fixed code in the appropriate file?<br /><br /><!--c1--><div class='codetop'>CODE</div><div class='codemain'><!--ec1-->            }<br />             $iLastMatch = $i;<br />             $j = $i;<br />-            $ret .= $res[1];<br />+            if ($htmlsave) {<br />+                $ret .= htmlspecialchars($res[1]);<br />+            } else {<br />+                $ret .= $res[1];<br />+            }<br />             $encoding = ucfirst($res[3]);<br />             switch ($encoding)<br />             {<br />             case 'B':<br />                 $replace = base64_decode($res[4]);<br />-                $ret .= charset_decode($res[2],$replace);<br />+                if ($utfencode) {<br />+                    $replace = charset_decode($res[2],$replace);<br />+                } elseif ($htmlsave) {<br />+                    $replace = htmlspecialchars($replace);<br />+                }<br />+                $ret .= $replace;<br />                 break;<br />             case 'Q':<br />                 $replace = str_replace('_', ' ', $res[4]);<!--c2--></div><!--ec2--><br /><br />I'm not a programmer; does the minus symbol <!--quoteo--><div class='quotetop'>QUOTE</div><div class='quotemain'><!--quotec-->-            $ret .= $res[1];<!--QuoteEnd--></div><!--QuoteEEnd--> at the beginning of the line mean to delete that line, I believe the plus symbol <!--quoteo--><div class='quotetop'>QUOTE</div><div class='quotemain'><!--quotec-->+                if ($utfencode) {<!--QuoteEnd--></div><!--QuoteEEnd--> means to add that line.<br /><br />thanks,<br />Stefan<!--content-->
Sounds correct to me. I'm assuming you have your own copy of Squirrelmail and not the one in cPanel.<br /><br />Moving for oraganization and exposure.<!--content-->
Thank you Bruce. I'll give it a try...<br /><br />...it seems to have worked. Squirrelmail didn't complain when I logged in. <img src="http://www.totalchoicehosting.com/forums/style_emoticons/default/smile.gif" style="vertical-align:middle" emoid="" border="0" alt="smile.gif" /> <br /><br />Stefan<!--content-->