From a77cf2292b1b5e010172b572f618aef78795456b Mon Sep 17 00:00:00 2001
From: thomascube <thomas@roundcube.net>
Date: Tue, 08 Feb 2011 03:13:06 -0500
Subject: [PATCH] Add optional referer check to prevent CSRF in GET requests
---
program/steps/utils/error.inc | 9 ++++++++-
1 files changed, 8 insertions(+), 1 deletions(-)
diff --git a/program/steps/utils/error.inc b/program/steps/utils/error.inc
index 422827a..8b04969 100644
--- a/program/steps/utils/error.inc
+++ b/program/steps/utils/error.inc
@@ -5,7 +5,7 @@
| program/steps/utils/error.inc |
| |
| This file is part of the Roundcube Webmail client |
- | Copyright (C) 2005-2010, The Roundcube Dev Team |
+ | Copyright (C) 2005-2011, The Roundcube Dev Team |
| Licensed under the GNU GPL |
| |
| PURPOSE: |
@@ -47,6 +47,13 @@
"Please contact your server-administrator.";
}
+// forbidden due to request check
+else if ($ERROR_CODE==403) {
+ $__error_title = "REQUEST CHECK FAILED";
+ $__error_text = "Access to this service was denied due to failing security checks!<br />\n".
+ "Please contact your server-administrator.";
+}
+
// failed request (wrong step in URL)
else if ($ERROR_CODE==404) {
$__error_title = "REQUEST FAILED/FILE NOT FOUND";
--
Gitblit v1.9.1