Re: [Regression] search results expired?
Paul Lesniewski <[email protected]>
| Newsgroups | gmane.mail.squirrelmail.devel |
|---|---|
| Message-ID | <[email protected]> |
On Sun, Aug 30, 2009 at 4:55 PM, Jonathan Angliss<[email protected]> wrote: > On Sun, 30 Aug 2009 14:28:31 +0200, Ralf Hildebrandt > <[email protected]> wrote: > >>* Ralf Hildebrandt <[email protected]>: >>> Hi there! >>> >>> With 1.4.20RC1 I'm getting this error: >>> >>> * search for anything using the "Search" link (e.g. Subject contains "test") >>> * I'm getting several results back >>> * I'm choosing a mail at random, and have it displayed >>> * I decide it's the wrong one and go back to the list of search results by >>> clicking on the link labeled "Search results" which leads me to: >>> https://webmail.example.com/squirrelmail/src/search.php?where=SUBJECT&what=test&mailbox=INBOX.Sent >>> * I'm getting an error page in the right frame: >>> "This page request could not be verified and appears to have expired." >>> >>> Could this be related to the recent changes in rc1 which are supposed >>> to foil cross site scripting? >> >>I tried 1.4.19, it doesn't show that particular behaviour! > > That would be because of some new improved security. Thanks for the > catch. > > http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13833 > > src/read_body.php is really the only change I can see you needing for > this issue. I did notice that the token validation only looked for > GET whilst it passed in a post too, so I made a little change there in > src/search.php as well. There are no forms using POST that point to src/search.php that I know of. I switched it back. -- Paul Lesniewski SquirrelMail Team Please support Open Source Software by donating to SquirrelMail! http://squirrelmail.org/donate_paul_lesniewski.php ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: [email protected] List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel