From 9e64dc2debfa1c7410f82bf71f4d10856751e258 Mon Sep 17 00:00:00 2001 From: Aleksander Machniak <alec@alec.pl> Date: Fri, 20 May 2016 08:36:45 -0400 Subject: [PATCH] Remove application/x-tar file extension test as it might not exist in nginx config (#5253) --- index.php | 96 +++++++++++++++++++++--------------------------- 1 files changed, 42 insertions(+), 54 deletions(-) diff --git a/index.php b/index.php index 7adb0be..e404c3b 100644 --- a/index.php +++ b/index.php @@ -1,10 +1,10 @@ <?php -/* +/** +-------------------------------------------------------------------------+ | Roundcube Webmail IMAP Client | - | Version 1.0-git | + | Version 1.3-git | | | - | Copyright (C) 2005-2013, The Roundcube Dev Team | + | Copyright (C) 2005-2015, The Roundcube Dev Team | | | | This program is free software: you can redistribute it and/or modify | | it under the terms of the GNU General Public License (with exceptions | @@ -40,10 +40,11 @@ require_once 'program/include/iniset.php'; // init application, start session, init output class, etc. -$RCMAIL = rcmail::get_instance($GLOBALS['env']); +$RCMAIL = rcmail::get_instance(0, $GLOBALS['env']); // Make the whole PHP output non-cacheable (#1487797) $RCMAIL->output->nocacheing_headers(); +$RCMAIL->output->common_headers(); // turn on output buffering ob_start(); @@ -61,12 +62,12 @@ rcmail::raise_error(array( 'code' => 603, 'type' => 'db', - 'message' => $err_str), FALSE, TRUE); + 'message' => $err_str), false, true); } // error steps if ($RCMAIL->action == 'error' && !empty($_GET['_code'])) { - rcmail::raise_error(array('code' => hexdec($_GET['_code'])), FALSE, TRUE); + rcmail::raise_error(array('code' => hexdec($_GET['_code'])), false, true); } // check if https is required (for login) and redirect if necessary @@ -89,9 +90,9 @@ // try to log in if ($RCMAIL->task == 'login' && $RCMAIL->action == 'login') { - $request_valid = $_SESSION['temp'] && $RCMAIL->check_request(rcube_utils::INPUT_POST, 'login'); + $request_valid = $_SESSION['temp'] && $RCMAIL->check_request(); - // purge the session in case of new login when a session already exists + // purge the session in case of new login when a session already exists $RCMAIL->kill_session(); $auth = $RCMAIL->plugins->exec_hook('authenticate', array( @@ -130,7 +131,7 @@ // prevent redirect to compose with specified ID (#1488226) if ($query['_action'] == 'compose' && !empty($query['_id'])) { - $query = array(); + $query = array('_action' => 'compose'); } } @@ -139,14 +140,14 @@ unset($redir['abort'], $redir['_err']); // send redirect - $OUTPUT->redirect($redir); + $OUTPUT->redirect($redir, 0, true); } else { if (!$auth['valid']) { $error_code = RCMAIL::ERROR_INVALID_REQUEST; } else { - $error_code = $auth['error'] ? $auth['error'] : $RCMAIL->login_error(); + $error_code = is_numeric($auth['error']) ? $auth['error'] : $RCMAIL->login_error(); } $error_labels = array( @@ -154,9 +155,10 @@ RCMAIL::ERROR_COOKIES_DISABLED => 'cookiesdisabled', RCMAIL::ERROR_INVALID_REQUEST => 'invalidrequest', RCMAIL::ERROR_INVALID_HOST => 'invalidhost', + RCMAIL::ERROR_RATE_LIMIT => 'accountlocked', ); - $error_message = $error_labels[$error_code] ? $error_labels[$error_code] : 'loginfailed'; + $error_message = !empty($auth['error']) && !is_numeric($auth['error']) ? $auth['error'] : ($error_labels[$error_code] ?: 'loginfailed'); $OUTPUT->show_message($error_message, 'warning'); @@ -170,10 +172,10 @@ } } -// end session (after optional referer check) -else if ($RCMAIL->task == 'logout' && isset($_SESSION['user_id']) - && (!$RCMAIL->config->get('referer_check') || rcube_utils::check_referer()) -) { +// end session +else if ($RCMAIL->task == 'logout' && isset($_SESSION['user_id'])) { + $RCMAIL->request_security_check($mode = rcube_utils::INPUT_GET); + $userdata = array( 'user' => $_SESSION['username'], 'host' => $_SESSION['storage_host'], @@ -188,7 +190,7 @@ } // check session and auth cookie -else if ($RCMAIL->task != 'login' && $_SESSION['user_id'] && $RCMAIL->action != 'send') { +else if ($RCMAIL->task != 'login' && $_SESSION['user_id']) { if (!$RCMAIL->session->check_auth()) { $RCMAIL->kill_session(); $session_error = true; @@ -207,6 +209,15 @@ $session_error = true; } + if ($session_error || $_REQUEST['_err'] == 'session') { + $OUTPUT->show_message('sessionerror', 'error', null, true, -1); + } + + if ($OUTPUT->ajax_call || $OUTPUT->get_env('framed')) { + $OUTPUT->command('session_error', $RCMAIL->url(array('_err' => 'session'))); + $OUTPUT->send('iframe'); + } + // check if installer is still active if ($RCMAIL->config->get('enable_installer') && is_readable('./installer/index.php')) { $OUTPUT->add_footer(html::div(array('style' => "background:#ef9398; border:2px solid #dc5757; padding:0.5em; margin:2em auto; width:50em"), @@ -218,46 +229,22 @@ )); } - if ($session_error || $_REQUEST['_err'] == 'session') { - $OUTPUT->show_message('sessionerror', 'error', null, true, -1); - } - - if ($OUTPUT->ajax_call || !empty($_REQUEST['_framed'])) { - $OUTPUT->command('session_error', $RCMAIL->url(array('_err' => 'session'))); - $OUTPUT->send('iframe'); - } - $plugin = $RCMAIL->plugins->exec_hook('unauthenticated', array('task' => 'login', 'error' => $session_error)); $RCMAIL->set_task($plugin['task']); $OUTPUT->send($plugin['task']); } -// CSRF prevention else { - // don't check for valid request tokens in these actions - $request_check_whitelist = array('login'=>1, 'spell'=>1, 'spell_html'=>1); + // CSRF prevention + $RCMAIL->request_security_check(); - if (!$request_check_whitelist[$RCMAIL->action]) { - // check client X-header to verify request origin - if ($OUTPUT->ajax_call) { - if (rcube_utils::request_header('X-Roundcube-Request') != $RCMAIL->get_request_token()) { - header('HTTP/1.1 403 Forbidden'); - die("Invalid Request"); - } - } - // check request token in POST form submissions - else if (!empty($_POST) && !$RCMAIL->check_request()) { - $OUTPUT->show_message('invalidrequest', 'error'); - $OUTPUT->send($RCMAIL->task); - } - - // check referer if configured - if ($RCMAIL->config->get('referer_check') && !rcube_utils::check_referer()) { - raise_error(array( - 'code' => 403, 'type' => 'php', - 'message' => "Referer check failed"), true, true); - } + // check access to disabled actions + $disabled_actions = (array) $RCMAIL->config->get('disabled_actions'); + if (in_array($RCMAIL->task . '.' . ($RCMAIL->action ?: 'index'), $disabled_actions)) { + rcube::raise_error(array( + 'code' => 403, 'type' => 'php', + 'message' => "Action disabled"), true, true); } } @@ -286,13 +273,14 @@ $redirects = 0; $incstep = null; while ($redirects < 5) { // execute a plugin action - if ($RCMAIL->plugins->is_plugin_task($RCMAIL->task)) { - if (!$RCMAIL->action) $RCMAIL->action = 'index'; - $RCMAIL->plugins->exec_action($RCMAIL->task.'.'.$RCMAIL->action); + if (preg_match('/^plugin\./', $RCMAIL->action)) { + $RCMAIL->plugins->exec_action($RCMAIL->action); break; } - else if (preg_match('/^plugin\./', $RCMAIL->action)) { - $RCMAIL->plugins->exec_action($RCMAIL->action); + // execute action registered to a plugin task + else if ($RCMAIL->plugins->is_plugin_task($RCMAIL->task)) { + if (!$RCMAIL->action) $RCMAIL->action = 'index'; + $RCMAIL->plugins->exec_action($RCMAIL->task.'.'.$RCMAIL->action); break; } // try to include the step file -- Gitblit v1.9.1