Protect download urls against CSRF using unique request tokens (#1490642) S...

Thomas Bruederli

2016-01-16 4a408843b0ef816daf70a472a02b78cd6073a4d5

 program/steps/addressbook/export.inc

@@ -1,6 +1,6 @@
<?php

/*
/**
 +-----------------------------------------------------------------------+
 | program/steps/addressbook/export.inc                                  |
 |                                                                       |
@@ -20,6 +20,8 @@
 | Author: Aleksander Machniak <machniak@kolabsys.com>                   |
 +-----------------------------------------------------------------------+
*/

$RCMAIL->request_security_check(rcube_utils::INPUT_GET);

// Use search result
if (!empty($_REQUEST['_search']) && isset($_SESSION['search'][$_REQUEST['_search']])) {
@@ -98,6 +100,14 @@
    $result = $CONTACTS->list_records(null, 0, true);
}

// Give plugins a possibility to implement other output formats or modify the result
$plugin = $RCMAIL->plugins->exec_hook('addressbook_export', array('result' => $result));
$result = $plugin['result'];

if ($plugin['abort']) {
    exit;
}

// send downlaod headers
header('Content-Type: text/x-vcard; charset='.RCUBE_CHARSET);
header('Content-Disposition: attachment; filename="contacts.vcf"');