Fix bug where 'skins_allowed' option didn't enforce user skin preference (#7080)

2 files changed, 12 insertions, 0 deletions

diff --git a/program/include/rcmail_output_html.php b/program/include/rcmail_output_html.php
index 891a64d84..0552b89c2 100644
--- a/program/include/rcmail_output_html.php
+++ b/program/include/rcmail_output_html.php
@@ -312,6 +312,12 @@ EOF;
             return false;
         }
 
+        $skins_allowed = $this->config->get('skins_allowed');
+
+        if (!empty($skins_allowed) && !in_array($skin, (array) $skins_allowed)) {
+            return false;
+        }
+
         $path = RCUBE_INSTALL_PATH . 'skins/';
 
         return !empty($skin) && is_dir($path . $skin) && is_readable($path . $skin);
diff --git a/program/lib/Roundcube/rcube_config.php b/program/lib/Roundcube/rcube_config.php
index f46fd1580..5226ac32a 100644
--- a/program/lib/Roundcube/rcube_config.php
+++ b/program/lib/Roundcube/rcube_config.php
@@ -455,6 +455,12 @@ class rcube_config
             $prefs['skin'] = self::DEFAULT_SKIN;
         }
 
+        $skins_allowed = $this->get('skins_allowed');
+
+        if (!empty($prefs['skin']) && !empty($skins_allowed) && !in_array($prefs['skin'], (array) $skins_allowed)) {
+            unset($prefs['skin']);
+        }
+
         $this->userprefs = $prefs;
         $this->prop      = array_merge($this->prop, $prefs);
     }