Fix bugs where CSRF attacks were still possible on some requests

1 files changed, 1 insertions, 0 deletions

diff --git a/index.php b/index.php
index 082f11ea4..a3f54bb27 100644
--- a/index.php
+++ b/index.php
@@ -172,6 +172,7 @@ if ($RCMAIL->task == 'login' && $RCMAIL->action == 'login') {
 
 // end session (after optional referer check)
 else if ($RCMAIL->task == 'logout' && isset($_SESSION['user_id'])
+    && $RCMAIL->check_request(rcube_utils::INPUT_GET)
     && (!$RCMAIL->config->get('referer_check') || rcube_utils::check_referer())
 ) {
     $userdata = array(