From 715c7961ba8ff72fe40720bb4feaa7865e57e8b9 Mon Sep 17 00:00:00 2001
From: thomascube <thomas@roundcube.net>
Date: Tue, 01 Mar 2011 16:22:52 -0500
Subject: [PATCH] Don't do exact matches when searching for existing email records
---
index.php | 12 ++++++++++--
1 files changed, 10 insertions(+), 2 deletions(-)
diff --git a/index.php b/index.php
index bf38874..1b15226 100644
--- a/index.php
+++ b/index.php
@@ -133,8 +133,8 @@
}
}
-// end session
-else if ($RCMAIL->task == 'logout' && isset($_SESSION['user_id'])) {
+// end session (after optional referer check)
+else if ($RCMAIL->task == 'logout' && isset($_SESSION['user_id']) && (!$RCMAIL->config->get('referer_check') || rcube_check_referer())) {
$userdata = array('user' => $_SESSION['username'], 'host' => $_SESSION['imap_host'], 'lang' => $RCMAIL->user->language);
$OUTPUT->show_message('loggedout');
$RCMAIL->logout_actions();
@@ -190,6 +190,14 @@
$OUTPUT->show_message('invalidrequest', 'error');
$OUTPUT->send($RCMAIL->task);
}
+
+ // check referer if configured
+ if (!$request_check_whitelist[$RCMAIL->action] && $RCMAIL->config->get('referer_check') && !rcube_check_referer()) {
+ raise_error(array(
+ 'code' => 403,
+ 'type' => 'php',
+ 'message' => "Referer check failed"), true, true);
+ }
}
// handle special actions
--
Gitblit v1.9.1