From abdf31486a946d63623c3047d08e7730926c4d86 Mon Sep 17 00:00:00 2001
From: thomascube <thomas@roundcube.net>
Date: Sun, 30 Oct 2011 07:34:31 -0400
Subject: [PATCH] Allow cross-task ajax requests
---
index.php | 2 +-
program/include/rcmail.php | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/index.php b/index.php
index a1eb545..dce3db3 100644
--- a/index.php
+++ b/index.php
@@ -195,7 +195,7 @@
// check client X-header to verify request origin
if ($OUTPUT->ajax_call) {
if (rc_request_header('X-Roundcube-Request') != $RCMAIL->get_request_token() && !$RCMAIL->config->get('devel_mode')) {
- header('HTTP/1.1 404 Not Found');
+ header('HTTP/1.1 403 Forbidden');
die("Invalid Request");
}
}
diff --git a/program/include/rcmail.php b/program/include/rcmail.php
index a4a783c..1ecdfcd 100644
--- a/program/include/rcmail.php
+++ b/program/include/rcmail.php
@@ -1268,7 +1268,7 @@
{
$sess_id = $_COOKIE[ini_get('session.name')];
if (!$sess_id) $sess_id = session_id();
- $plugin = $this->plugins->exec_hook('request_token', array('value' => md5('RT' . $this->task . $this->config->get('des_key') . $sess_id)));
+ $plugin = $this->plugins->exec_hook('request_token', array('value' => md5('RT' . $this->user->ID . $this->config->get('des_key') . $sess_id)));
return $plugin['value'];
}
--
Gitblit v1.9.1