Improve system security by using optional special URL with security token

Allows to define separate server/path for image/js/css files
Fix bugs where CSRF attacks were still possible on some requests

1 files changed, 5 insertions, 0 deletions

diff --git a/program/include/rcmail_output_json.php b/program/include/rcmail_output_json.php
index fa35824db..91262acb3 100644
--- a/program/include/rcmail_output_json.php
+++ b/program/include/rcmail_output_json.php
@@ -181,6 +181,11 @@ class rcmail_output_json extends rcmail_output
      */
     public function raise_error($code, $message)
     {
+        if ($code == 403) {
+            header('HTTP/1.1 403 Forbidden');
+            die("Invalid Request");
+        }
+
         $this->show_message("Application Error ($code): $message", 'error');
         $this->remote_response();
         exit;