From 6b0dab16efeb4c003aa4e8c927738bd40945de1d Mon Sep 17 00:00:00 2001 From: thomasb Date: Sun, 30 Oct 2011 11:34:31 +0000 Subject: Allow cross-task ajax requests git-svn-id: https://svn.roundcube.net/trunk@5375 208e9e7b-5314-0410-a742-e7e81cd9613c --- roundcubemail/index.php | 2 +- roundcubemail/program/include/rcmail.php | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/roundcubemail/index.php b/roundcubemail/index.php index a1eb54587..dce3db36d 100644 --- a/roundcubemail/index.php +++ b/roundcubemail/index.php @@ -195,7 +195,7 @@ else { // check client X-header to verify request origin if ($OUTPUT->ajax_call) { if (rc_request_header('X-Roundcube-Request') != $RCMAIL->get_request_token() && !$RCMAIL->config->get('devel_mode')) { - header('HTTP/1.1 404 Not Found'); + header('HTTP/1.1 403 Forbidden'); die("Invalid Request"); } } diff --git a/roundcubemail/program/include/rcmail.php b/roundcubemail/program/include/rcmail.php index a4a783c80..1ecdfcde0 100644 --- a/roundcubemail/program/include/rcmail.php +++ b/roundcubemail/program/include/rcmail.php @@ -1268,7 +1268,7 @@ class rcmail { $sess_id = $_COOKIE[ini_get('session.name')]; if (!$sess_id) $sess_id = session_id(); - $plugin = $this->plugins->exec_hook('request_token', array('value' => md5('RT' . $this->task . $this->config->get('des_key') . $sess_id))); + $plugin = $this->plugins->exec_hook('request_token', array('value' => md5('RT' . $this->user->ID . $this->config->get('des_key') . $sess_id))); return $plugin['value']; } -- cgit v1.2.3