Changeset ebc619c in github


Ignore:
Timestamp:
Feb 26, 2010 3:06:48 AM (3 years ago)
Author:
alecpl <alec@…>
Branches:
master, HEAD, courier-fix, dev-browser-capabilities, pdo, release-0.6, release-0.7, release-0.8
Children:
72b140d
Parents:
3d0ec76
Message:
  • Fix CVE-2010-0464: Disable DNS prefetching (#1486449)
Files:
3 edited

Legend:

Unmodified
Added
Removed

  • CHANGELOG

    r82c98e6 rebc619c  
    22=========================== 
    33 
     4- Fix CVE-2010-0464: Disable DNS prefetching (#1486449) 
    45- Fix Received headers to behave better with SpamAssassin (#1486513) 
    56- Password: Make passwords encoding consistent with core, add 'password_charset' global option (#1486473) 

  • program/include/rcube_shared.inc

    r3e638020 rebc619c  
    4040  header("Cache-Control: private, must-revalidate, post-check=0, pre-check=0"); 
    4141  header("Pragma: no-cache"); 
     42  // Request browser to disable DNS prefetching (CVE-2010-0464) 
     43  header("X-DNS-Prefetch-Control: off"); 
    4244   
    4345  // We need to set the following headers to make downloads work using IE in HTTPS mode. 

  • program/steps/mail/get.inc

    r6d479a6 rebc619c  
    4242} 
    4343 
     44send_nocacheing_headers(); 
    4445 
    4546// show part page 
    … …  
    6768    $browser = new rcube_browser; 
    6869 
    69     send_nocacheing_headers(); 
    70      
    7170    // send download headers 
    7271    if ($_GET['_download']) { 
Note: See TracChangeset for help on using the changeset viewer.