summaryrefslogtreecommitdiff
path: root/program/steps/utils
diff options
context:
space:
mode:
authorthomascube <thomas@roundcube.net>2011-02-08 08:13:06 +0000
committerthomascube <thomas@roundcube.net>2011-02-08 08:13:06 +0000
commita77cf2292b1b5e010172b572f618aef78795456b (patch)
treed9fbb4dcfd86852db6528d977838d983bffdda1f /program/steps/utils
parent61846d1ad3b0f40ac90e12f8dcd1ac9a95ebd296 (diff)
Add optional referer check to prevent CSRF in GET requests
Diffstat (limited to 'program/steps/utils')
-rw-r--r--program/steps/utils/error.inc9
1 files changed, 8 insertions, 1 deletions
diff --git a/program/steps/utils/error.inc b/program/steps/utils/error.inc
index 422827a23..8b0496911 100644
--- a/program/steps/utils/error.inc
+++ b/program/steps/utils/error.inc
@@ -5,7 +5,7 @@
| program/steps/utils/error.inc |
| |
| This file is part of the Roundcube Webmail client |
- | Copyright (C) 2005-2010, The Roundcube Dev Team |
+ | Copyright (C) 2005-2011, The Roundcube Dev Team |
| Licensed under the GNU GPL |
| |
| PURPOSE: |
@@ -47,6 +47,13 @@ else if ($ERROR_CODE==401) {
"Please contact your server-administrator.";
}
+// forbidden due to request check
+else if ($ERROR_CODE==403) {
+ $__error_title = "REQUEST CHECK FAILED";
+ $__error_text = "Access to this service was denied due to failing security checks!<br />\n".
+ "Please contact your server-administrator.";
+}
+
// failed request (wrong step in URL)
else if ($ERROR_CODE==404) {
$__error_title = "REQUEST FAILED/FILE NOT FOUND";