Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-08-28 11:39:21 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Secure #79

Browse source
This commit is contained in:
djmaze 2021-04-09 09:42:09 +02:00
parent 4ee905c568
commit 49e5a88daa
2 changed files with 12 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

13
snappymail/v/0.0.0/app/libraries/snappymail/dav/client.php
View file

@ -51,7 +51,7 @@ class Client
$this->HTTP->setAuth(3, $settings['userName'] ?? '', $settings['password'] ?? '');
$this->HTTP->max_response_kb = 0;
$this->HTTP->timeout = 15; // timeout in seconds.
$this->HTTP->max_redirects = 1;
// $this->HTTP->max_redirects = 0;
}
/**
@ -98,7 +98,7 @@ class Client
$body .= ' </d:prop>' . "\n";
$body .= '</d:propfind>';
if (!\preg_match('/^http(s?):\/\//', $url)) {
if (!\preg_match('@^(https?:)?//@', $url)) {
// If the url starts with a slash, we must calculate the url based off
// the root of the base url.
if (0 === \strpos($url, '/')) {
@ -112,6 +112,15 @@ class Client
"Depth: {$depth}",
'Content-Type: application/xml'
));
if (301 == $response->status) {
$url = preg_replace('@^(https?:)?//[^/]+/@', '/', $result->getRedirectLocation());
$parts = \parse_url($this->baseUri);
$url = $parts['scheme'] . '://' . $parts['host'] . (isset($parts['port'])?':' . $parts['port']:'') . $url;
$response = $this->HTTP->doRequest('PROPFIND', $url, $body, array(
"Depth: {$depth}",
'Content-Type: application/xml'
));
}
if (300 <= $response->status) {
throw new \SnappyMail\HTTP\Exception('', $response->status, $response);
}

2
snappymail/v/0.0.0/app/libraries/snappymail/http/request.php
View file

@ -133,7 +133,7 @@ abstract class Request
// http://www.w3.org/Protocols/rfc2616/rfc2616-sec10.html#sec10.3
// In response to a request other than GET or HEAD, the user agent MUST NOT
// automatically redirect the request unless it can be confirmed by the user
if ($redirects-- && \in_array($result->status, array(301, 302, 303, 307)) && \in_array($method, ['GET','HEAD','PROPFIND'])) {
if ($redirects-- && \in_array($result->status, array(301, 302, 303, 307)) && \in_array($method, ['GET','HEAD'])) {
$url = $result->getRedirectLocation();
} else {
$result->final_uri = $url;