diff options
| author | alec <alec@208e9e7b-5314-0410-a742-e7e81cd9613c> | 2010-06-17 08:01:20 +0000 |
|---|---|---|
| committer | alec <alec@208e9e7b-5314-0410-a742-e7e81cd9613c> | 2010-06-17 08:01:20 +0000 |
| commit | 2456a3181102773e541b4c8c908932c5dd2f3ae0 (patch) | |
| tree | 9201d3437a0c7959e8362323cd6bfa7b618448d8 | |
| parent | f1cff40b1238b01020b37ba31f10463019bf2017 (diff) | |
- Fix no-cache headers on https to prevent content caching by proxies (#1486798)
git-svn-id: https://svn.roundcube.net/trunk@3756 208e9e7b-5314-0410-a742-e7e81cd9613c
| -rw-r--r-- | roundcubemail/CHANGELOG | 1 | ||||
| -rw-r--r-- | roundcubemail/program/include/rcube_shared.inc | 11 |
2 files changed, 7 insertions, 5 deletions
diff --git a/roundcubemail/CHANGELOG b/roundcubemail/CHANGELOG index f4b13d7e6..9ecbbe60d 100644 --- a/roundcubemail/CHANGELOG +++ b/roundcubemail/CHANGELOG @@ -1,6 +1,7 @@ CHANGELOG RoundCube Webmail =========================== +- Fix no-cache headers on https to prevent content caching by proxies (#1486798) - Fix attachment filenames broken with TNEF decoder using long filenames (#1486795) - Use user's timezone in Date header, not server's timezone (#1486119) - Add option to set separate footer for HTML messages (#1486660) diff --git a/roundcubemail/program/include/rcube_shared.inc b/roundcubemail/program/include/rcube_shared.inc index 3ab76917d..a643f4438 100644 --- a/roundcubemail/program/include/rcube_shared.inc +++ b/roundcubemail/program/include/rcube_shared.inc @@ -32,20 +32,21 @@ */ function send_nocacheing_headers() { + global $OUTPUT; + if (headers_sent()) return; header("Expires: ".gmdate("D, d M Y H:i:s")." GMT"); header("Last-Modified: ".gmdate("D, d M Y H:i:s")." GMT"); - header("Cache-Control: private, must-revalidate, post-check=0, pre-check=0"); + header("Cache-Control: private, no-cache, must-revalidate, post-check=0, pre-check=0"); header("Pragma: no-cache"); // Request browser to disable DNS prefetching (CVE-2010-0464) header("X-DNS-Prefetch-Control: off"); - + // We need to set the following headers to make downloads work using IE in HTTPS mode. - if (rcube_https_check()) { - header('Pragma: '); - header('Cache-Control: '); + if ($OUTPUT->browser->ie && rcube_https_check()) { + header('Pragma: private'); } } |