From 681ba6fc3c296cd6cd11050531b8f4e785141786 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 16 Dec 2014 07:28:48 -0500
Subject: [PATCH] Improve system security by using optional special URL with security token Allows to define separate server/path for image/js/css files Fix bugs where CSRF attacks were still possible on some requests
---
program/include/rcmail_output_json.php | 5 +++++
1 files changed, 5 insertions(+), 0 deletions(-)
diff --git a/program/include/rcmail_output_json.php b/program/include/rcmail_output_json.php
index fa35824..91262ac 100644
--- a/program/include/rcmail_output_json.php
+++ b/program/include/rcmail_output_json.php
@@ -181,6 +181,11 @@
*/
public function raise_error($code, $message)
{
+ if ($code == 403) {
+ header('HTTP/1.1 403 Forbidden');
+ die("Invalid Request");
+ }
+
$this->show_message("Application Error ($code): $message", 'error');
$this->remote_response();
exit;
--
Gitblit v1.9.1