diff options
author | thomascube <thomas@roundcube.net> | 2011-02-08 11:13:06 +0300 |
---|---|---|
committer | thomascube <thomas@roundcube.net> | 2011-02-08 11:13:06 +0300 |
commit | a77cf2292b1b5e010172b572f618aef78795456b (patch) | |
tree | d9fbb4dcfd86852db6528d977838d983bffdda1f /index.php | |
parent | 61846d1ad3b0f40ac90e12f8dcd1ac9a95ebd296 (diff) |
Add optional referer check to prevent CSRF in GET requests
Diffstat (limited to 'index.php')
-rw-r--r-- | index.php | 8 |
1 files changed, 8 insertions, 0 deletions
@@ -190,6 +190,14 @@ else { $OUTPUT->show_message('invalidrequest', 'error'); $OUTPUT->send($RCMAIL->task); } + + // check referer if configured + if (!$request_check_whitelist[$RCMAIL->action] && $RCMAIL->config->get('referer_check') && !rcube_check_referer()) { + raise_error(array( + 'code' => 403, + 'type' => 'php', + 'message' => "Referer check failed"), true, true); + } } // handle special actions |