the-djmaze/snappymail
1
1
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2025-11-08 06:11:37 +08:00
Code Issues Projects Releases Packages Wiki Activity

Force token for #892

Browse source
This commit is contained in:
the-djmaze 2023-01-31 10:49:06 +01:00
parent 977dc1e5e4
commit b1c9bebce6
4 changed files with 3 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
.docker/release/files/usr/local/include/application.ini
View file

@ -53,8 +53,6 @@ pdo_password = ""
suggestions_limit = 30
[security]
; Enable CSRF protection (http://en.wikipedia.org/wiki/Cross-site_request_forgery)
csrf_protection = On
custom_server_signature = "SnappyMail"
x_xss_protection_header = "1; mode=block"
openpgp = Off

2
snappymail/v/0.0.0/app/libraries/RainLoop/Actions.php
View file

@ -621,7 +621,7 @@ class Actions
'System' => \array_merge(
array(
'version' => APP_VERSION,
'token' => $oConfig->Get('security', 'csrf_protection', true) ? Utils::GetCsrfToken() : '',
'token' => Utils::GetCsrfToken(),
'languages' => \SnappyMail\L10n::getLanguages(false),
'webPath' => \RainLoop\Utils::WebPath(),
'webVersionPath' => \RainLoop\Utils::WebVersionPath()

3
snappymail/v/0.0.0/app/libraries/RainLoop/Config/Application.php
View file

@ -183,9 +183,6 @@ class Application extends \RainLoop\Config\AbstractConfig
),
'security' => array(
'csrf_protection' => array(true,
'Enable CSRF protection (http://en.wikipedia.org/wiki/Cross-site_request_forgery)'),
'custom_server_signature' => array('SnappyMail'),
'x_xss_protection_header' => array('1; mode=block'),

7
snappymail/v/0.0.0/app/libraries/RainLoop/ServiceActions.php
View file

@ -92,11 +92,8 @@ class ServiceActions
throw new Exceptions\ClientException(Notifications::InvalidInputArgument, null, 'Action unknown');
}
if ($this->oHttp->IsPost() &&
$this->Config()->Get('security', 'csrf_protection', true) &&
($_POST['XToken'] ?? '') !== Utils::GetCsrfToken())
{
throw new Exceptions\ClientException(Notifications::InvalidToken, null, 'CSRF failed');
if ($this->oHttp->IsPost() && ($_POST['XToken'] ?? '') !== Utils::GetCsrfToken()) {
throw new Exceptions\ClientException(Notifications::InvalidToken, null, 'Token mismatch');
}
if ($this->oActions instanceof ActionsAdmin && 0 === \stripos($sAction, 'Admin') && !\in_array($sAction, ['AdminLogin', 'AdminLogout'])) {