Re: [Regression] search results expired?
Jonathan Angliss <[email protected]>
| Newsgroups | gmane.mail.squirrelmail.devel |
|---|---|
| Message-ID | <[email protected]> |
On Sun, 30 Aug 2009 14:28:31 +0200, Ralf Hildebrandt <[email protected]> wrote: >* Ralf Hildebrandt <[email protected]>: >> Hi there! >> >> With 1.4.20RC1 I'm getting this error: >> >> * search for anything using the "Search" link (e.g. Subject contains "test") >> * I'm getting several results back >> * I'm choosing a mail at random, and have it displayed >> * I decide it's the wrong one and go back to the list of search results by >> clicking on the link labeled "Search results" which leads me to: >> https://webmail.example.com/squirrelmail/src/search.php?where=SUBJECT&what=test&mailbox=INBOX.Sent >> * I'm getting an error page in the right frame: >> "This page request could not be verified and appears to have expired." >> >> Could this be related to the recent changes in rc1 which are supposed >> to foil cross site scripting? > >I tried 1.4.19, it doesn't show that particular behaviour! That would be because of some new improved security. Thanks for the catch. http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13833 src/read_body.php is really the only change I can see you needing for this issue. I did notice that the token validation only looked for GET whilst it passed in a post too, so I made a little change there in src/search.php as well. -- Jonathan Angliss <[email protected]> ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: [email protected] List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel