diff options
| -rw-r--r-- | CHANGELOG | 1 | ||||
| -rw-r--r-- | index.php | 39 | ||||
| -rw-r--r-- | program/steps/utils/killcache.inc | 10 |
3 files changed, 21 insertions, 29 deletions
@@ -1,6 +1,7 @@ CHANGELOG Roundcube Webmail =========================== +- Fix (disable) request validation for spell and spell_html actions - Add new DB abstraction layer based on PHP PDO, supporting SQLite3 (#1488332) - Removed PEAR::MDB2 package - Removed users.alias column, added option ('user_aliases') @@ -219,27 +219,28 @@ if (empty($RCMAIL->user->ID)) { // CSRF prevention else { // don't check for valid request tokens in these actions - $request_check_whitelist = array('login'=>1, 'spell'=>1); - - // check client X-header to verify request origin - if ($OUTPUT->ajax_call) { - if (rcube_utils::request_header('X-Roundcube-Request') != $RCMAIL->get_request_token() && !$RCMAIL->config->get('devel_mode')) { - header('HTTP/1.1 403 Forbidden'); - die("Invalid Request"); + $request_check_whitelist = array('login'=>1, 'spell'=>1, 'spell_html'=>1); + + if (!$request_check_whitelist[$RCMAIL->action]) { + // check client X-header to verify request origin + if ($OUTPUT->ajax_call) { + if (rcube_utils::request_header('X-Roundcube-Request') != $RCMAIL->get_request_token()) { + header('HTTP/1.1 403 Forbidden'); + die("Invalid Request"); + } + } + // check request token in POST form submissions + else if (!empty($_POST) && !$RCMAIL->check_request()) { + $OUTPUT->show_message('invalidrequest', 'error'); + $OUTPUT->send($RCMAIL->task); } - } - // check request token in POST form submissions - else if (!empty($_POST) && !$request_check_whitelist[$RCMAIL->action] && !$RCMAIL->check_request()) { - $OUTPUT->show_message('invalidrequest', 'error'); - $OUTPUT->send($RCMAIL->task); - } - // check referer if configured - if (!$request_check_whitelist[$RCMAIL->action] && $RCMAIL->config->get('referer_check') && !rcmail::check_referer()) { - raise_error(array( - 'code' => 403, - 'type' => 'php', - 'message' => "Referer check failed"), true, true); + // check referer if configured + if ($RCMAIL->config->get('referer_check') && !rcmail::check_referer()) { + raise_error(array( + 'code' => 403, 'type' => 'php', + 'message' => "Referer check failed"), true, true); + } } } diff --git a/program/steps/utils/killcache.inc b/program/steps/utils/killcache.inc index eb9645089..033cdd075 100644 --- a/program/steps/utils/killcache.inc +++ b/program/steps/utils/killcache.inc @@ -25,16 +25,6 @@ if (!$RCMAIL->config->get('devel_mode')) { die("Access denied!"); } -$options = array( - 'use_transactions' => false, - 'log_line_break' => "\n", - 'idxname_format' => '%s', - 'debug' => false, - 'quote_identifier' => true, - 'force_defaults' => false, - 'portability' => true -); - // @TODO: transaction here (if supported by DB) would be a good thing $res = $RCMAIL->db->query("DELETE FROM cache"); if (PEAR::isError($res)) { |