From 376cbfd4f2dfcf455717409b70d9d056cbeb08b1 Mon Sep 17 00:00:00 2001 From: Aleksander Machniak Date: Mon, 15 Dec 2014 13:47:55 +0100 Subject: Fix bugs where CSRF attacks were still possible on some requests --- index.php | 1 + 1 file changed, 1 insertion(+) (limited to 'index.php') diff --git a/index.php b/index.php index 082f11ea4..a3f54bb27 100644 --- a/index.php +++ b/index.php @@ -172,6 +172,7 @@ if ($RCMAIL->task == 'login' && $RCMAIL->action == 'login') { // end session (after optional referer check) else if ($RCMAIL->task == 'logout' && isset($_SESSION['user_id']) + && $RCMAIL->check_request(rcube_utils::INPUT_GET) && (!$RCMAIL->config->get('referer_check') || rcube_utils::check_referer()) ) { $userdata = array( -- cgit v1.2.3