Protect attachment download urls against csrf using unique request tokens (...

Thomas Bruederli

2016-01-16 97f3972c9fdcf840cc979f1d9cdc139f2da09395

 program/include/rcmail.php

@@ -840,6 +840,8 @@
            // this need to be full url to make redirects work
            $absolute = true;
        }
        else if ($secure && ($token = $this->get_request_token()))
            $url .= $delm . '_token=' . urlencode($token);

        if ($absolute || $full) {
            // add base path to this Roundcube installation