Dereku/snappymail
0
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-11-03 10:58:50 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Resolve #585 by allowing additional Sec-Fetch rules

Browse source
This commit is contained in:
the-djmaze 2022-11-09 11:19:05 +01:00
parent 3992d9d5f7
commit 895abd09be
3 changed files with 42 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

2
snappymail/v/0.0.0/app/libraries/RainLoop/Service.php
View file

@ -101,7 +101,7 @@ abstract class Service
$sResult = '';
if (\count($aPaths) && !empty($aPaths[0]) && 'index' !== \strtolower($aPaths[0]))
{
if ('mailto' !== \strtolower($aPaths[0]) && !\SnappyMail\HTTP\SecFetch::isSameOrigin()) {
if ('mailto' !== \strtolower($aPaths[0]) && !\SnappyMail\HTTP\SecFetch::matchAnyRule($oConfig->Get('security', 'secfetch_allow', ''))) {
\MailSo\Base\Http::StatusHeader(403);
echo $oServiceActions->ErrorTemplates('Access Denied.',
"Disallowed Sec-Fetch