Allow cross-task ajax requests

git-svn-id: https://svn.roundcube.net/trunk@5375 208e9e7b-5314-0410-a742-e7e81cd9613c

2 files changed, 2 insertions, 2 deletions

diff --git a/roundcubemail/index.php b/roundcubemail/index.php
index a1eb54587..dce3db36d 100644
--- a/roundcubemail/index.php
+++ b/roundcubemail/index.php
@@ -195,7 +195,7 @@ else {
   // check client X-header to verify request origin
   if ($OUTPUT->ajax_call) {
     if (rc_request_header('X-Roundcube-Request') != $RCMAIL->get_request_token() && !$RCMAIL->config->get('devel_mode')) {
-      header('HTTP/1.1 404 Not Found');
+      header('HTTP/1.1 403 Forbidden');
       die("Invalid Request");
     }
   }
diff --git a/roundcubemail/program/include/rcmail.php b/roundcubemail/program/include/rcmail.php
index a4a783c80..1ecdfcde0 100644
--- a/roundcubemail/program/include/rcmail.php
+++ b/roundcubemail/program/include/rcmail.php
@@ -1268,7 +1268,7 @@ class rcmail
   {
     $sess_id = $_COOKIE[ini_get('session.name')];
     if (!$sess_id) $sess_id = session_id();
-    $plugin = $this->plugins->exec_hook('request_token', array('value' => md5('RT' . $this->task . $this->config->get('des_key') . $sess_id)));
+    $plugin = $this->plugins->exec_hook('request_token', array('value' => md5('RT' . $this->user->ID . $this->config->get('des_key') . $sess_id)));
     return $plugin['value'];
   }