Changeset 784a425 in github for index.php

Timestamp:

Feb 3, 2011 5:08:03 PM (2 years ago)

Author:

thomascube <thomas@…>

Branches:

master, HEAD, courier-fix, dev-browser-capabilities, pdo, release-0.6, release-0.7, release-0.8

Children:

89d19c4

Parents:

6ec4658

Message:

protect login form submission from CSRF using a request token

File:

• index.php (modified) (5 diffs)

index.php

@@ -76 +76 @@
 // try to log in
 if ($RCMAIL->task == 'login' && $RCMAIL->action == 'login') {
+  $request_valid = $_SESSION['temp'] && $RCMAIL->check_request(RCUBE_INPUT_POST, 'login');
+
   // purge the session in case of new login when a session already exists 
   $RCMAIL->kill_session();
@@ -85 +87 @@
        $RCMAIL->config->get('password_charset', 'ISO-8859-1')),
     'cookiecheck' => true,
+    'valid' => $request_valid,
   ));
 
@@ -91 +94 @@
     $OUTPUT->show_message("cookiesdisabled", 'warning');
   }
-  else if ($_SESSION['temp'] && !$auth['abort'] &&
+  else if ($auth['valid'] && !$auth['abort'] &&
         !empty($auth['host']) && !empty($auth['user']) &&
         $RCMAIL->login($auth['user'], $auth['pass'], $auth['host'])) {
@@ -124 +127 @@
     $error_code = is_object($IMAP) ? $IMAP->get_error_code() : -1;
 
-    $OUTPUT->show_message($error_code < -1 ? 'imaperror' : 'loginfailed', 'warning');
+    $OUTPUT->show_message($error_code < -1 ? 'imaperror' : (!$auth['valid'] ? 'invalidrequest' : 'loginfailed'), 'warning');
     $RCMAIL->plugins->exec_hook('login_failed', array(
       'code' => $error_code, 'host' => $auth['host'], 'user' => $auth['user']));
@@ -168 +171 @@
   }
 
-  $OUTPUT->set_env('task', 'login');
+  $RCMAIL->set_task('login');
   $OUTPUT->send('login');
 }