Use HTTP-POST requests for actions that change application state

thomascube

2007-05-18 8d07583f3920f27186ccc16ea1ecb49104f1e32d

 program/steps/mail/compose.inc

@@ -29,7 +29,7 @@


// remove an attachment
if ($_action=='remove-attachment' && preg_match('/^rcmfile([0-9]+)$/', $_GET['_file'], $regs))
if ($_action=='remove-attachment' && preg_match('/^rcmfile([0-9]+)$/', $_POST['_file'], $regs))
  {
  $id = $regs[1];
  if (is_array($_SESSION['compose']['attachments'][$id]))