Files
webmin/postfix/detach_queue.cgi
Ilia Ross ae8feb1854
Some checks failed
Tests / prove (push) Has been cancelled
Package and upload artifacts / build (push) Has been cancelled
Fix remaining mail queue attachment XSS
Follow up to: https://github.com/webmin/webmin/commit/dda9b97
2026-10-16 01:46:06 +02:00

30 lines
807 B
Perl
Executable File

#!/usr/local/bin/perl
# detach_queue.cgi
# View one attachment from a queued message
require './postfix-lib.pl'; ## no critic
use strict;
use warnings;
our ($attach, $mail, %access, %in, %text);
require './boxes-lib.pl'; ## no critic
&ReadParse();
$access{'mailq'} || &error($text{'mailq_ecannot'});
$mail = &parse_queue_file($in{'id'});
$mail || &error($text{'mailq_egone'});
&parse_mail($mail);
$attach = $mail->{'attach'}->[$in{'attach'}];
print "X-no-links: 1\n";
if ($attach->{'type'} eq 'message/delivery-status' ||
$attach->{'type'} =~ /^text\/html/i ||
$attach->{'type'} =~ /^image\/svg(?:\+xml)?/i ||
$attach->{'type'} =~ /^application\/xhtml\+xml/i) {
print "Content-type: text/plain\n\n";
}
else {
print "Content-type: $attach->{'type'}\n\n";
}
print $attach->{'data'};