hannob

--- squirrelmail.stable/squirrelmail/class/deliver/Deliver.class.php	2017-01-27 21:31:33.000000000 +0100
+++ htdocs/class/deliver/Deliver.class.php	2018-03-14 17:21:10.320000000 +0100
@@ -281,6 +281,7 @@
                 global $username, $attachment_dir;
                 $hashed_attachment_dir = getHashedDir($username, $attachment_dir);
                 $filename = $message->att_local_name;
+		if(!ctype_alnum($filename)) die();
 
                 // inspect attached file for lines longer than allowed by RFC,
                 // in which case we'll be using base64 encoding (so we can split

peterhost

#!/bin/sh
# ------------------------------------------------------------------------------ 
# SOME INFOS : fairly standard (debian) init script.
#                 Note that node doesn't create a PID file (hence --make-pidfile) 
#                 has to be run in the background (hence --background)
#                 and NOT as root (hence --chuid)
#
# MORE INFOS :  INIT SCRIPT       http://www.debian.org/doc/debian-policy/ch-opersys.html#s-sysvinit
#               INIT-INFO RULES   http://wiki.debian.org/LSBInitScripts
#               INSTALL/REMOVE    http://www.debian-administration.org/articles/28