diff options
author | Aleksander Machniak <alec@alec.pl> | 2014-12-16 13:28:48 +0100 |
---|---|---|
committer | Aleksander Machniak <alec@alec.pl> | 2014-12-16 13:28:48 +0100 |
commit | 681ba6fc3c296cd6cd11050531b8f4e785141786 (patch) | |
tree | 77cd99edc9536c1e85e5ee057d231aa3aa5e0aba /program/steps/mail | |
parent | 53b7421d4419ce12c62d47e5b1231240cefdc3d5 (diff) |
Improve system security by using optional special URL with security token
Allows to define separate server/path for image/js/css files
Fix bugs where CSRF attacks were still possible on some requests
Diffstat (limited to 'program/steps/mail')
-rw-r--r-- | program/steps/mail/compose.inc | 2 | ||||
-rw-r--r-- | program/steps/mail/show.inc | 8 |
2 files changed, 5 insertions, 5 deletions
diff --git a/program/steps/mail/compose.inc b/program/steps/mail/compose.inc index 5492f390d..fd25cf402 100644 --- a/program/steps/mail/compose.inc +++ b/program/steps/mail/compose.inc @@ -951,7 +951,7 @@ function rcmail_compose_body($attrib) "googie.setCurrentLanguage('%s');\n". "googie.setDecoration(false);\n". "googie.decorateTextarea('%s');\n", - $RCMAIL->output->get_skin_path(), + $RCMAIL->output->asset_url($RCMAIL->output->get_skin_path()), $RCMAIL->url(array('_task' => 'utils', '_action' => 'spell', '_remote' => 1)), !empty($dictionary) ? 'true' : 'false', rcube::JQ(rcube::Q($RCMAIL->gettext('checkspelling'))), diff --git a/program/steps/mail/show.inc b/program/steps/mail/show.inc index 5adc97900..d9233a923 100644 --- a/program/steps/mail/show.inc +++ b/program/steps/mail/show.inc @@ -341,20 +341,20 @@ function rcmail_message_contactphoto($attrib) { global $RCMAIL, $MESSAGE; - $placeholder = $attrib['placeholder'] ? $RCMAIL->config->get('skin_path') . $attrib['placeholder'] : null; + $placeholder = $attrib['placeholder'] ? $RCMAIL->output->abs_url($attrib['placeholder'], true) : null; + $placeholder = $RCMAIL->output->asset_url($placeholder ? $placeholder : 'program/resources/blank.gif'); if ($MESSAGE->sender) { $photo_img = $RCMAIL->url(array( '_task' => 'addressbook', '_action' => 'photo', '_email' => $MESSAGE->sender['mailto'], - '_alt' => $placeholder, )); - $attrib['onerror'] = "this.src = '" . ($placeholder ? $placeholder : 'program/resources/blank.gif') . "'"; + $attrib['onerror'] = "this.src = '$placeholder'"; } else { - $photo_img = $placeholder ? $placeholder : 'program/resources/blank.gif'; + $photo_img = $placeholder; } return html::img(array('src' => $photo_img, 'alt' => $RCMAIL->gettext('contactphoto')) + $attrib); |