Dereku/snappymail
0
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-11-03 19:08:50 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Force token for #892

Browse source
This commit is contained in:
the-djmaze 2023-01-31 10:49:06 +01:00
parent 977dc1e5e4
commit b1c9bebce6
4 changed files with 3 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

7
snappymail/v/0.0.0/app/libraries/RainLoop/ServiceActions.php
View file

@ -92,11 +92,8 @@ class ServiceActions
throw new Exceptions\ClientException(Notifications::InvalidInputArgument, null, 'Action unknown');
}
if ($this->oHttp->IsPost() &&
$this->Config()->Get('security', 'csrf_protection', true) &&
($_POST['XToken'] ?? '') !== Utils::GetCsrfToken())
{
throw new Exceptions\ClientException(Notifications::InvalidToken, null, 'CSRF failed');
if ($this->oHttp->IsPost() && ($_POST['XToken'] ?? '') !== Utils::GetCsrfToken()) {
throw new Exceptions\ClientException(Notifications::InvalidToken, null, 'Token mismatch');
}
if ($this->oActions instanceof ActionsAdmin && 0 === \stripos($sAction, 'Admin') && !\in_array($sAction, ['AdminLogin', 'AdminLogout'])) {