Security fix to avoid arbitrary code execution when using Zarafa database user backend

Without this patch the following works:
- Set PLUGIN_PASSWD_USER_DEFAULT_ENABLE in passwd/config.php to true
- Logon at Zarafa WebApp, go to "Settings", choose "Change Password"
- Change the password successfully to e.g. "password; touch /tmp/abc"
- Result: -rw-r--r--. 1 apache apache 0 Feb 13 01:06 /tmp/abc

php/class.passwdmodule.php

@@ -165,8 +165,7 @@ class PasswdModule extends Module
 	}
 
 	/**
-	 * Function will execute zarafa-passwd command and will try to change user's password,
-	 * this method is unsecure and unreliable.
+	 * Function will try to change user's password via MAPI in SOAP connection.
 	 * @param {Array} $data data sent by client.
 	 */
 	public function saveInDB($data)
@@ -176,13 +175,11 @@ class PasswdModule extends Module
 		$passwdRepeat = $data['new_password_repeat'];
 
 		if($this->checkPasswordStrenth($passwd)) {
-			$passwd_cmd = '/usr/bin/zarafa-passwd -u %s -o %s -p %s';
-
 			// all information correct, change password
-			$cmd = sprintf($passwd_cmd, $data['username'], $data['current_password'], $passwd);
-			exec($cmd, $arrayout, $retval);
+			$store = $GLOBALS['mapisession']->getDefaultMessageStore();
+			$userinfo = mapi_zarafa_getuser_by_name($store, $data['username']);
 
-			if ($retval === 0) {
+			if (mapi_zarafa_setuser($store, $userinfo['userid'], $data['username'], $userinfo['fullname'], $userinfo['emailaddress'], $passwd, 0, $userinfo['admin'])) {
 				// password changed successfully
 
 				// write new password to session because we don't want user to re-authenticate