From 681ba6fc3c296cd6cd11050531b8f4e785141786 Mon Sep 17 00:00:00 2001
From: Aleksander Machniak <alec@alec.pl>
Date: Tue, 16 Dec 2014 07:28:48 -0500
Subject: [PATCH] Improve system security by using optional special URL with security token Allows to define separate server/path for image/js/css files Fix bugs where CSRF attacks were still possible on some requests
---
program/steps/mail/compose.inc | 9 +++++----
1 files changed, 5 insertions(+), 4 deletions(-)
diff --git a/program/steps/mail/compose.inc b/program/steps/mail/compose.inc
index bfb2fac..fd25cf4 100644
--- a/program/steps/mail/compose.inc
+++ b/program/steps/mail/compose.inc
@@ -131,8 +131,10 @@
$compose_mode = RCUBE_COMPOSE_EDIT;
}
-$COMPOSE['mode'] = $compose_mode;
-$OUTPUT->set_env('compose_mode', $compose_mode);
+if ($compose_mode) {
+ $COMPOSE['mode'] = $compose_mode;
+ $OUTPUT->set_env('compose_mode', $compose_mode);
+}
if ($compose_mode == RCUBE_COMPOSE_EDIT || $compose_mode == RCUBE_COMPOSE_DRAFT) {
// don't add signature in draft/edit mode, we'll also not remove the old-one
@@ -949,7 +951,7 @@
"googie.setCurrentLanguage('%s');\n".
"googie.setDecoration(false);\n".
"googie.decorateTextarea('%s');\n",
- $RCMAIL->output->get_skin_path(),
+ $RCMAIL->output->asset_url($RCMAIL->output->get_skin_path()),
$RCMAIL->url(array('_task' => 'utils', '_action' => 'spell', '_remote' => 1)),
!empty($dictionary) ? 'true' : 'false',
rcube::JQ(rcube::Q($RCMAIL->gettext('checkspelling'))),
@@ -1732,7 +1734,6 @@
'noselection' => '- ' . $RCMAIL->gettext('dontsave') . ' -',
'folder_filter' => 'mail',
'folder_rights' => 'w',
- 'realnames' => $RCMAIL->config->get('show_real_foldernames'),
)));
return $select->show(isset($_POST['_store_target']) ? $_POST['_store_target'] : $COMPOSE['param']['sent_mbox'], $attrib);
--
Gitblit v1.9.1