Dereku/snappymail
1
0
Fork 0
mirror of https://github.com/the-djmaze/snappymail.git synced 2026-08-25 10:09:20 +03:00
Code Issues Projects Releases Packages Wiki Activity Actions

Force token for #892

Browse source
This commit is contained in:
the-djmaze 2023-01-31 10:49:06 +01:00
parent 977dc1e5e4
commit b1c9bebce6
4 changed files with 3 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

2
.docker/release/files/usr/local/include/application.ini
View file

@ -53,8 +53,6 @@ pdo_password = ""
suggestions_limit = 30 suggestions_limit = 30
[security] [security]
; Enable CSRF protection (http://en.wikipedia.org/wiki/Cross-site_request_forgery)
csrf_protection = On
custom_server_signature = "SnappyMail" custom_server_signature = "SnappyMail"
x_xss_protection_header = "1; mode=block" x_xss_protection_header = "1; mode=block"
openpgp = Off openpgp = Off

2
snappymail/v/0.0.0/app/libraries/RainLoop/Actions.php
View file

@ -621,7 +621,7 @@ class Actions
'System' => \array_merge( 'System' => \array_merge(
array( array(
'version' => APP_VERSION, 'version' => APP_VERSION,
'token' => $oConfig->Get('security', 'csrf_protection', true) ? Utils::GetCsrfToken() : '', 'token' => Utils::GetCsrfToken(),
'languages' => \SnappyMail\L10n::getLanguages(false), 'languages' => \SnappyMail\L10n::getLanguages(false),
'webPath' => \RainLoop\Utils::WebPath(), 'webPath' => \RainLoop\Utils::WebPath(),
'webVersionPath' => \RainLoop\Utils::WebVersionPath() 'webVersionPath' => \RainLoop\Utils::WebVersionPath()

3
snappymail/v/0.0.0/app/libraries/RainLoop/Config/Application.php
View file

@ -183,9 +183,6 @@ class Application extends \RainLoop\Config\AbstractConfig
), ),
'security' => array( 'security' => array(
'csrf_protection' => array(true,
'Enable CSRF protection (http://en.wikipedia.org/wiki/Cross-site_request_forgery)'),
'custom_server_signature' => array('SnappyMail'), 'custom_server_signature' => array('SnappyMail'),
'x_xss_protection_header' => array('1; mode=block'), 'x_xss_protection_header' => array('1; mode=block'),

7
snappymail/v/0.0.0/app/libraries/RainLoop/ServiceActions.php
View file

@ -92,11 +92,8 @@ class ServiceActions
throw new Exceptions\ClientException(Notifications::InvalidInputArgument, null, 'Action unknown'); throw new Exceptions\ClientException(Notifications::InvalidInputArgument, null, 'Action unknown');
} }
if ($this->oHttp->IsPost() && if ($this->oHttp->IsPost() && ($_POST['XToken'] ?? '') !== Utils::GetCsrfToken()) {
$this->Config()->Get('security', 'csrf_protection', true) && throw new Exceptions\ClientException(Notifications::InvalidToken, null, 'Token mismatch');
($_POST['XToken'] ?? '') !== Utils::GetCsrfToken())
{
throw new Exceptions\ClientException(Notifications::InvalidToken, null, 'CSRF failed');
} }
if ($this->oActions instanceof ActionsAdmin && 0 === \stripos($sAction, 'Admin') && !\in_array($sAction, ['AdminLogin', 'AdminLogout'])) { if ($this->oActions instanceof ActionsAdmin && 0 === \stripos($sAction, 'Admin') && !\in_array($sAction, ['AdminLogin', 'AdminLogout'])) {