Another problem with "search results expired"

Neil Hoggarth <[email protected]>
Newsgroups gmane.mail.squirrelmail.devel
Message-ID <[email protected]>
I have found another code path which can give rise to the "ERROR - This 
page request could not be verified and appears to have expired" problem 
in src/search.php, in both 1.4.20-RC2 and SM-1_4-STABLE SVN branch.

To reproduce:

1. Perform a search.

2. Select a message from the search results (taking us to
    src/read_body.php).

3  Click the "Delete" link above the message headers (taking us to
    src/delete_message.php, with a valid smtoken).

4. src/delete_message.php does delete the message, but then generates a
    redirect to src/search.php without including an smtoken in the URL.

Proposed patch, which seems to fix things for our installation (diff -u 
against SM-1_4-STABLE branch, r13840):

--- src/delete_message.php~	2009-09-18 13:58:23.000000000 +0100
+++ src/delete_message.php	2009-09-18 13:58:46.000000000 +0100
@@ -78,6 +78,7 @@

  if (isset($where) && isset($what)) {
      header("Location: $location/search.php?where=" . $where .
+           '&smtoken=' . sm_generate_security_token() .
             '&what=' . $what . '&mailbox=' . urlencode($mailbox));
  } else {
      if (!empty($saved_draft) || !empty($mail_sent)) {


Regards,
-- 
Neil Hoggarth -------------- Department of Physiology, Anatomy and Genetics
Head of IT --------------------------------------- University of Oxford, UK


------------------------------------------------------------------------------
Come build with us! The BlackBerry&reg; Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay 
ahead of the curve. Join us from November 9&#45;12, 2009. Register now&#33;
http://p.sf.net/sfu/devconf
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: [email protected]
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.