From b1c9bebce6ed2a919e15b653ddf5e2ab01fca56c Mon Sep 17 00:00:00 2001
From: the-djmaze <>
Date: Tue, 31 Jan 2023 10:49:06 +0100
Subject: [PATCH] Force token for #892

---
 .docker/release/files/usr/local/include/application.ini    | 2 --
 snappymail/v/0.0.0/app/libraries/RainLoop/Actions.php      | 2 +-
 .../v/0.0.0/app/libraries/RainLoop/Config/Application.php  | 3 ---
 .../v/0.0.0/app/libraries/RainLoop/ServiceActions.php      | 7 ++-----
 4 files changed, 3 insertions(+), 11 deletions(-)

diff --git a/.docker/release/files/usr/local/include/application.ini b/.docker/release/files/usr/local/include/application.ini
index 0d04a1343..3d9db4e5e 100644
--- a/.docker/release/files/usr/local/include/application.ini
+++ b/.docker/release/files/usr/local/include/application.ini
@@ -53,8 +53,6 @@ pdo_password = ""
 suggestions_limit = 30
 
 [security]
-; Enable CSRF protection (http://en.wikipedia.org/wiki/Cross-site_request_forgery)
-csrf_protection = On
 custom_server_signature = "SnappyMail"
 x_xss_protection_header = "1; mode=block"
 openpgp = Off
diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions.php b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions.php
index 64c398008..870a7cb00 100644
--- a/snappymail/v/0.0.0/app/libraries/RainLoop/Actions.php
+++ b/snappymail/v/0.0.0/app/libraries/RainLoop/Actions.php
@@ -621,7 +621,7 @@ class Actions
 			'System' => \array_merge(
 				array(
 					'version' => APP_VERSION,
-					'token' => $oConfig->Get('security', 'csrf_protection', true) ? Utils::GetCsrfToken() : '',
+					'token' => Utils::GetCsrfToken(),
 					'languages' => \SnappyMail\L10n::getLanguages(false),
 					'webPath' => \RainLoop\Utils::WebPath(),
 					'webVersionPath' => \RainLoop\Utils::WebVersionPath()
diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/Config/Application.php b/snappymail/v/0.0.0/app/libraries/RainLoop/Config/Application.php
index 309a951ec..41f1b49f6 100644
--- a/snappymail/v/0.0.0/app/libraries/RainLoop/Config/Application.php
+++ b/snappymail/v/0.0.0/app/libraries/RainLoop/Config/Application.php
@@ -183,9 +183,6 @@ class Application extends \RainLoop\Config\AbstractConfig
 			),
 
 			'security' => array(
-				'csrf_protection'    => array(true,
-				    'Enable CSRF protection (http://en.wikipedia.org/wiki/Cross-site_request_forgery)'),
-
 				'custom_server_signature'    => array('SnappyMail'),
 				'x_xss_protection_header'    => array('1; mode=block'),
 
diff --git a/snappymail/v/0.0.0/app/libraries/RainLoop/ServiceActions.php b/snappymail/v/0.0.0/app/libraries/RainLoop/ServiceActions.php
index fb7b2b5f7..8ba58fb84 100644
--- a/snappymail/v/0.0.0/app/libraries/RainLoop/ServiceActions.php
+++ b/snappymail/v/0.0.0/app/libraries/RainLoop/ServiceActions.php
@@ -92,11 +92,8 @@ class ServiceActions
 				throw new Exceptions\ClientException(Notifications::InvalidInputArgument, null, 'Action unknown');
 			}
 
-			if ($this->oHttp->IsPost() &&
-				$this->Config()->Get('security', 'csrf_protection', true) &&
-				($_POST['XToken'] ?? '') !== Utils::GetCsrfToken())
-			{
-				throw new Exceptions\ClientException(Notifications::InvalidToken, null, 'CSRF failed');
+			if ($this->oHttp->IsPost() && ($_POST['XToken'] ?? '') !== Utils::GetCsrfToken()) {
+				throw new Exceptions\ClientException(Notifications::InvalidToken, null, 'Token mismatch');
 			}
 
 			if ($this->oActions instanceof ActionsAdmin && 0 === \stripos($sAction, 'Admin') && !\in_array($sAction, ['AdminLogin', 'AdminLogout'])) {