summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAleksander Machniak <alec@alec.pl>2012-08-08 08:55:46 +0200
committerAleksander Machniak <alec@alec.pl>2012-08-08 08:55:46 +0200
commitb807084a6b33c96d2568456f367b1c5a8384660c (patch)
treea4928dd45cd01395c0205aeba8f49d8f62e94536
parent2bbc3da52aee81e920e46778d68278bd31f7bb6b (diff)
- Fix (disable) request validation for spell and spell_html actions
Consider action whitelist also for ajax requests
-rw-r--r--CHANGELOG1
-rw-r--r--index.php39
2 files changed, 21 insertions, 19 deletions
diff --git a/CHANGELOG b/CHANGELOG
index ba7d1a139..4ff82a480 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,6 +1,7 @@
CHANGELOG Roundcube Webmail
===========================
+- Fix (disable) request validation for spell and spell_html actions
- Add new DB abstraction layer based on PHP PDO, supporting SQLite3 (#1488332)
- Removed PEAR::MDB2 package
- Removed users.alias column, added option ('user_aliases')
diff --git a/index.php b/index.php
index 143d90f45..0ad371a4a 100644
--- a/index.php
+++ b/index.php
@@ -219,27 +219,28 @@ if (empty($RCMAIL->user->ID)) {
// CSRF prevention
else {
// don't check for valid request tokens in these actions
- $request_check_whitelist = array('login'=>1, 'spell'=>1);
-
- // check client X-header to verify request origin
- if ($OUTPUT->ajax_call) {
- if (rcube_utils::request_header('X-Roundcube-Request') != $RCMAIL->get_request_token()) {
- header('HTTP/1.1 403 Forbidden');
- die("Invalid Request");
+ $request_check_whitelist = array('login'=>1, 'spell'=>1, 'spell_html'=>1);
+
+ if (!$request_check_whitelist[$RCMAIL->action]) {
+ // check client X-header to verify request origin
+ if ($OUTPUT->ajax_call) {
+ if (rcube_utils::request_header('X-Roundcube-Request') != $RCMAIL->get_request_token()) {
+ header('HTTP/1.1 403 Forbidden');
+ die("Invalid Request");
+ }
+ }
+ // check request token in POST form submissions
+ else if (!empty($_POST) && !$RCMAIL->check_request()) {
+ $OUTPUT->show_message('invalidrequest', 'error');
+ $OUTPUT->send($RCMAIL->task);
}
- }
- // check request token in POST form submissions
- else if (!empty($_POST) && !$request_check_whitelist[$RCMAIL->action] && !$RCMAIL->check_request()) {
- $OUTPUT->show_message('invalidrequest', 'error');
- $OUTPUT->send($RCMAIL->task);
- }
- // check referer if configured
- if (!$request_check_whitelist[$RCMAIL->action] && $RCMAIL->config->get('referer_check') && !rcmail::check_referer()) {
- raise_error(array(
- 'code' => 403,
- 'type' => 'php',
- 'message' => "Referer check failed"), true, true);
+ // check referer if configured
+ if ($RCMAIL->config->get('referer_check') && !rcmail::check_referer()) {
+ raise_error(array(
+ 'code' => 403, 'type' => 'php',
+ 'message' => "Referer check failed"), true, true);
+ }
}
}