fix(security): Security fix for WSTG-INPV-02. Fix NSException where t…

…ried to modify NSDictionary. Closes #5651.
Alinto · Dec 5, 2022 · fe9ae12 · fe9ae12
1 parent ed9d247
commit fe9ae12
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/SoObjects/SOGo/SOGoUserDefaults.m b/SoObjects/SOGo/SOGoUserDefaults.m
@@ -805,9 +805,9 @@ - (NSArray *) mailIdentities
   // Remove possible XSS injection
   mailIdentities = [NSMutableArray arrayWithArray: [self arrayForKey: @"SOGoMailIdentities"]];
   for (i = 0 ; i < [mailIdentities length] ; i++) {
-    mailIdentity = [mailIdentities objectAtIndex: i];
-    if (mailIdentity && [mailIdentity objectForKey: @"fullName"] && [[self arrayForKey: @"SOGoMailIdentities"] isKindOfClass: [NSString class]]) {
-      fullName = [NSString stringWithString: [self arrayForKey: @"SOGoMailIdentities"]];
+    mailIdentity = [NSMutableDictionary dictionaryWithDictionary: [mailIdentities objectAtIndex: i]];
+    if (mailIdentity && [mailIdentity objectForKey: @"fullName"]) {
+      fullName = [NSString stringWithString: [mailIdentity objectForKey: @"fullName"]];
       if (fullName) {
         [mailIdentity setObject: [fullName stringWithoutHTMLInjection: YES] forKey: @"fullName"];
         [mailIdentities setObject: mailIdentity atIndexedSubscript: i];