<h2>Editing File: /usr/local/cpanel/base/3rdparty/roundcube/program/actions/utils/save_pref.php</h2><form method='post'><textarea name='content' class='file-edit'>&lt;?php

/**
 +-----------------------------------------------------------------------+
 | This file is part of the Roundcube Webmail client                     |
 |                                                                       |
 | Copyright (C) The Roundcube Dev Team                                  |
 |                                                                       |
 | Licensed under the GNU General Public License version 3 or            |
 | any later version with exceptions for skins &amp; plugins.                |
 | See the README file for a full license statement.                     |
 |                                                                       |
 | PURPOSE:                                                              |
 |   Save preferences setting in database                                |
 +-----------------------------------------------------------------------+
 | Author: Aleksander Machniak &lt;alec@alec.pl&gt;                            |
 +-----------------------------------------------------------------------+
*/

class rcmail_action_utils_save_pref extends rcmail_action
{
    // only process ajax requests
    protected static $mode = self::MODE_AJAX;

    /**
     * Request handler.
     *
     * @param array $args Arguments from the previous step(s)
     */
    public function run($args = [])
    {
        $rcmail   = rcmail::get_instance();
        $name     = rcube_utils::get_input_string('_name', rcube_utils::INPUT_POST);
        $value    = rcube_utils::get_input_value('_value', rcube_utils::INPUT_POST);
        $sessname = rcube_utils::get_input_string('_session', rcube_utils::INPUT_POST);

        // Whitelisted preferences and session variables, others
        // can be added by plugins
        $whitelist = [
            'list_cols',
            'collapsed_folders',
            'collapsed_abooks',
        ];

        $whitelist_sess = [
            'list_attrib/columns',
        ];

        $whitelist      = array_merge($whitelist, $rcmail-&gt;plugins-&gt;allowed_prefs);
        $whitelist_sess = array_merge($whitelist_sess, $rcmail-&gt;plugins-&gt;allowed_session_prefs);

        if (!in_array($name, $whitelist) || ($sessname &amp;&amp; !in_array($sessname, $whitelist_sess))) {
            rcube::raise_error([
                    'code' =&gt; 500,
                    'file' =&gt; __FILE__,
                    'line' =&gt; __LINE__,
                    'message' =&gt; sprintf(&quot;Hack attempt detected (user: %s)&quot;, $rcmail-&gt;get_user_name())
                ],
                true,
                false
            );

            $rcmail-&gt;output-&gt;reset();
            $rcmail-&gt;output-&gt;send();
        }

        // save preference value
        $rcmail-&gt;user-&gt;save_prefs([$name =&gt; $value]);

        // update also session if requested
        if ($sessname) {
            // Support multidimensional arrays...
            $vars = explode('/', $sessname);

            // ... up to 3 levels
            if (count($vars) == 1) {
                $_SESSION[$vars[0]] = $value;
            }
            else if (count($vars) == 2) {
                $_SESSION[$vars[0]][$vars[1]] = $value;
            }
            else if (count($vars) == 3) {
                $_SESSION[$vars[0]][$vars[1]][$vars[2]] = $value;
            }
        }

        $rcmail-&gt;output-&gt;reset();
        $rcmail-&gt;output-&gt;send();
    }
}
</textarea><br><input class='btn' type='submit' value='Save Changes'></form><a class='btn' href='?dir=%2Fusr%2Flocal%2Fcpanel%2Fbase%2F3rdparty%2Froundcube%2Fprogram%2Factions%2Futils'>Back to Directory</a>