Force ajax calls to protect from CSRF

thomascube

2009-07-16 881217a5c95dbfe4e62154a2c0edd135b504220e

 program/steps/addressbook/delete.inc

@@ -5,7 +5,7 @@
 | program/steps/addressbook/delete.inc                                  |
 |                                                                       |
 | This file is part of the RoundCube Webmail client                     |
 | Copyright (C) 2005-2007, RoundCube Dev. - Switzerland                 |
 | Copyright (C) 2005-2009, RoundCube Dev. - Switzerland                 |
 | Licensed under the GNU GPL                                            |
 |                                                                       |
 | PURPOSE:                                                              |
@@ -19,7 +19,8 @@

*/

if (($cid = get_input_value('_cid', RCUBE_INPUT_POST)) &&
if ($OUTPUT->ajax_call &&
    ($cid = get_input_value('_cid', RCUBE_INPUT_POST)) &&
    (preg_match('/^[0-9]+(,[0-9]+)*$/', $cid) ||
     preg_match('/^[a-zA-Z0-9=]+(,[a-zA-Z0-9=]+)*$/', $cid))
   )