Protect download urls against CSRF using unique request tokens (#1490642) S...

Thomas Bruederli

2016-01-16 4a408843b0ef816daf70a472a02b78cd6073a4d5

 program/lib/Roundcube/rcube_message.php

@@ -108,7 +108,8 @@
            'get_url'     => $this->app->url(array(
                    'action' => 'get',
                    'mbox'   => $this->folder,
                    'uid'    => $uid))
                    'uid'    => $uid),
                false, false, true)
        );

        if (!empty($this->headers->structure)) {
@@ -339,6 +340,7 @@

                $level = explode('.', $part->mime_id);
                $depth = count($level);
                $last  = '';

                // Check if the part belongs to higher-level's multipart part
                // this can be alternative/related/signed/encrypted or mixed
@@ -348,9 +350,12 @@
                        return true;
                    }

                    $parent = $this->mime_parts[join('.', $level)];
                    $parent    = $this->mime_parts[join('.', $level)];
                    $max_delta = $depth - (1 + ($last == 'multipart/alternative' ? 1 : 0));
                    $last      = $parent->mimetype;

                    if (!preg_match('/^multipart\/(alternative|related|signed|encrypted|mixed)$/', $parent->mimetype)
                        || ($parent->mimetype == 'multipart/mixed' && $parent_depth < $depth - 1)) {
                        || ($parent->mimetype == 'multipart/mixed' && $parent_depth < $max_delta)) {
                        continue 2;
                    }
                }