From 174327c25cd68f203e0985df51b94765738c7dce Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 11 Jun 2013 03:33:21 -0400
Subject: [PATCH] Merge pull request #77 from dpc22/realnames
---
index.php | 50 +++++++++++++++++++++++++++-----------------------
1 files changed, 27 insertions(+), 23 deletions(-)
diff --git a/index.php b/index.php
index 143d90f..5d52571 100644
--- a/index.php
+++ b/index.php
@@ -2,9 +2,9 @@
/*
+-------------------------------------------------------------------------+
| Roundcube Webmail IMAP Client |
- | Version 0.9-git |
+ | Version 1.0-git |
| |
- | Copyright (C) 2005-2012, The Roundcube Dev Team |
+ | Copyright (C) 2005-2013, The Roundcube Dev Team |
| |
| This program is free software: you can redistribute it and/or modify |
| it under the terms of the GNU General Public License (with exceptions |
@@ -161,7 +161,7 @@
}
// end session (after optional referer check)
-else if ($RCMAIL->task == 'logout' && isset($_SESSION['user_id']) && (!$RCMAIL->config->get('referer_check') || rcmail::check_referer())) {
+else if ($RCMAIL->task == 'logout' && isset($_SESSION['user_id']) && (!$RCMAIL->config->get('referer_check') || rcube_utils::check_referer())) {
$userdata = array(
'user' => $_SESSION['username'],
'host' => $_SESSION['storage_host'],
@@ -219,27 +219,28 @@
// CSRF prevention
else {
// don't check for valid request tokens in these actions
- $request_check_whitelist = array('login'=>1, 'spell'=>1);
+ $request_check_whitelist = array('login'=>1, 'spell'=>1, 'spell_html'=>1);
- // check client X-header to verify request origin
- if ($OUTPUT->ajax_call) {
- if (rcube_utils::request_header('X-Roundcube-Request') != $RCMAIL->get_request_token()) {
- header('HTTP/1.1 403 Forbidden');
- die("Invalid Request");
+ if (!$request_check_whitelist[$RCMAIL->action]) {
+ // check client X-header to verify request origin
+ if ($OUTPUT->ajax_call) {
+ if (rcube_utils::request_header('X-Roundcube-Request') != $RCMAIL->get_request_token()) {
+ header('HTTP/1.1 403 Forbidden');
+ die("Invalid Request");
+ }
}
- }
- // check request token in POST form submissions
- else if (!empty($_POST) && !$request_check_whitelist[$RCMAIL->action] && !$RCMAIL->check_request()) {
- $OUTPUT->show_message('invalidrequest', 'error');
- $OUTPUT->send($RCMAIL->task);
- }
+ // check request token in POST form submissions
+ else if (!empty($_POST) && !$RCMAIL->check_request()) {
+ $OUTPUT->show_message('invalidrequest', 'error');
+ $OUTPUT->send($RCMAIL->task);
+ }
- // check referer if configured
- if (!$request_check_whitelist[$RCMAIL->action] && $RCMAIL->config->get('referer_check') && !rcmail::check_referer()) {
- raise_error(array(
- 'code' => 403,
- 'type' => 'php',
- 'message' => "Referer check failed"), true, true);
+ // check referer if configured
+ if ($RCMAIL->config->get('referer_check') && !rcube_utils::check_referer()) {
+ raise_error(array(
+ 'code' => 403, 'type' => 'php',
+ 'message' => "Referer check failed"), true, true);
+ }
}
}
@@ -247,7 +248,6 @@
$plugin = $RCMAIL->plugins->exec_hook('ready', array('task' => $RCMAIL->task, 'action' => $RCMAIL->action));
$RCMAIL->set_task($plugin['task']);
$RCMAIL->action = $plugin['action'];
-
// handle special actions
if ($RCMAIL->action == 'keep-alive') {
@@ -281,7 +281,8 @@
else if (($stepfile = $RCMAIL->get_action_file())
&& is_file($incfile = INSTALL_PATH . 'program/steps/'.$RCMAIL->task.'/'.$stepfile)
) {
- include $incfile;
+ // include action file only once (in case it don't exit)
+ include_once $incfile;
$redirects++;
}
else {
@@ -289,6 +290,9 @@
}
}
+if ($RCMAIL->action == 'refresh') {
+ $RCMAIL->plugins->exec_hook('refresh', array());
+}
// parse main template (default)
$OUTPUT->send($RCMAIL->task);
--
Gitblit v1.9.1