Use Horde:: equivalents for token checking.

diff --git a/imp/compose.php b/imp/compose.php
index 142d6af..238652b 100644 (file)
--- a/imp/compose.php
+++ b/imp/compose.php
@@ -104,7 +104,7 @@ if ($actionID) {
 
     default:
         try {
-            IMP::checkRequestToken('imp.compose', Horde_Util::getFormData('compose_requestToken'));
+            Horde::checkRequestToken('imp.compose', Horde_Util::getFormData('compose_requestToken'));
         } catch (Horde_Exception $e) {
             $notification->push($e);
             $actionID = null;
@@ -818,7 +818,7 @@ if ($redirect) {
     $t->set('index', htmlspecialchars($index));
     $t->set('status', Horde_Util::bufferOutput(array('IMP', 'status')));
     $t->set('title', htmlspecialchars($title));
-    $t->set('token', IMP::getRequestToken('imp.compose'));
+    $t->set('token', Horde::getRequestToken('imp.compose'));
 
     if ($registry->hasMethod('contacts/search')) {
         $t->set('has_search', true);
@@ -878,7 +878,7 @@ if ($redirect) {
     $hidden = array(
         'actionID' => '',
         'user' => $_SESSION['imp']['uniquser'],
-        'compose_requestToken' => IMP::getRequestToken('imp.compose'),
+        'compose_requestToken' => Horde::getRequestToken('imp.compose'),
         'compose_formToken' => Horde_Token::generateId('compose'),
         'composeCache' => $composeCacheID,
         'mailbox' => htmlspecialchars($imp_mbox['mailbox']),

diff --git a/imp/config/conf.xml b/imp/config/conf.xml
index 8a37f2b..d900875 100644 (file)
--- a/imp/config/conf.xml
+++ b/imp/config/conf.xml
@@ -135,10 +135,6 @@
    next login. If IMP will be the exclusive means of accessing the mail server,
    or you are not concerned about this behavior, this setting should be set to
    true.">true</configboolean>
-   <configinteger name="token_lifetime" desc="This is the length of time in
-   seconds that links protected with request tokens (to prevent cross-site
-   request forgery) will be valid. Higher values may make your users more
-   vulnerable to these attacks.">1800</configinteger>
    <configswitch name="cachejs" desc="Cache static javascript and combine into
    a single page for delivery to the remote browser?">none
     <case name="none" desc="No" />

diff --git a/imp/folders.php b/imp/folders.php
index 9cbf209..90a82e8 100644 (file)
--- a/imp/folders.php
+++ b/imp/folders.php
@@ -79,7 +79,7 @@ $open_compose_window = null;
 $actionID = Horde_Util::getFormData('actionID');
 if ($actionID) {
     try {
-        IMP::checkRequestToken('imp.folders', Horde_Util::getFormData('folders_token'));
+        Horde::checkRequestToken('imp.folders', Horde_Util::getFormData('folders_token'));
     } catch (Horde_Exception $e) {
         $notification->push($e);
         $actionID = null;
@@ -275,7 +275,7 @@ case 'folders_empty_mailbox_confirm':
         $template->set('empty', ($actionID == 'folders_empty_mailbox_confirm'));
         $template->set('folders', $loop);
         $template->set('folders_url', $folders_url);
-        $template->set('folders_token', IMP::getRequestToken('imp.folders'));
+        $template->set('folders_token', Horde::getRequestToken('imp.folders'));
         echo $template->fetch(IMP_TEMPLATES . '/folders/folders_confirm.html');
 
         require $registry->get('templates', 'horde') . '/common-footer.inc';
@@ -324,7 +324,7 @@ case 'mbox_size':
 }
 
 /* Token to use in requests */
-$folders_token = IMP::getRequestToken('imp.folders');
+$folders_token = Horde::getRequestToken('imp.folders');
 
 $folders_url = Horde_Util::addParameter($folders_url, 'folders_token', $folders_token);
 

diff --git a/imp/lib/Contents.php b/imp/lib/Contents.php
index 0f341fa..3fa4dc3 100644 (file)
--- a/imp/lib/Contents.php
+++ b/imp/lib/Contents.php
@@ -624,7 +624,7 @@ class IMP_Contents
             (intval($id) != 1) &&
             (strpos($id, '.') === false)) {
             $url = Horde_Util::removeParameter(Horde::selfUrl(true), array('actionID', 'imapid', 'index'));
-            $url = Horde_Util::addParameter($url, array('actionID' => 'strip_attachment', 'imapid' => $id, 'index' => $this->_index, 'message_token' => IMP::getRequestToken('imp.impcontents')));
+            $url = Horde_Util::addParameter($url, array('actionID' => 'strip_attachment', 'imapid' => $id, 'index' => $this->_index, 'message_token' => Horde::getRequestToken('imp.impcontents')));
             $part['strip'] = Horde::link($url, _("Strip Attachment"), 'stripAtc', null, "return window.confirm('" . addslashes(_("Are you sure you wish to PERMANENTLY delete this attachment?")) . "');") . '</a>';
         }
 

diff --git a/imp/lib/IMP.php b/imp/lib/IMP.php
index a78e5b2..7b6877d 100644 (file)
--- a/imp/lib/IMP.php
+++ b/imp/lib/IMP.php
@@ -94,39 +94,6 @@ class IMP
     }
 
     /**
-     * Get a token for protecting a form.
-     *
-     * @param string $slug  TODO
-     *
-     * @return  TODO
-     */
-    static public function getRequestToken($slug)
-    {
-        $token = Horde_Token::generateId($slug);
-        $_SESSION['horde_form_secrets'][$token] = time();
-        return $token;
-    }
-
-    /**
-     * Check if a token for a form is valid.
-     *
-     * @param string $slug   TODO
-     * @param string $token  TODO
-     *
-     * @throws Horde_Exception
-     */
-    static public function checkRequestToken($slug, $token)
-    {
-        if (empty($_SESSION['horde_form_secrets'][$token])) {
-            throw new Horde_Exception(_("We cannot verify that this request was really sent by you. It could be a malicious request. If you intended to perform this action, you can retry it now."));
-        }
-
-        if ($_SESSION['horde_form_secrets'][$token] + $GLOBALS['conf']['server']['token_lifetime'] < time()) {
-            throw new Horde_Exception(sprintf(_("This request cannot be completed because the link you followed or the form you submitted was only valid for %d minutes. Please try again now."), round($GLOBALS['conf']['server']['token_lifetime'] / 60)));
-        }
-    }
-
-    /**
      * Returns the plain text label that is displayed for the current mailbox,
      * replacing virtual search mailboxes with an appropriate description and
      * removing namespace and mailbox prefix information from what is shown to

diff --git a/imp/lib/Search.php b/imp/lib/Search.php
index ba2fa3e..66f1177 100644 (file)
--- a/imp/lib/Search.php
+++ b/imp/lib/Search.php
@@ -605,7 +605,7 @@ class IMP_Search
         $id = $this->_strip($id);
         return Horde_Util::addParameter(Horde::applicationUrl('folders.php'),
                                   array('actionID' => 'delete_search_query',
-                                        'folders_token' => IMP::getRequestToken('imp.folders'),
+                                        'folders_token' => Horde::getRequestToken('imp.folders'),
                                         'queryid' => $id,
                                   ));
     }

diff --git a/imp/lib/Session.php b/imp/lib/Session.php
index c1c9f26..d4905cb 100644 (file)
--- a/imp/lib/Session.php
+++ b/imp/lib/Session.php
@@ -352,9 +352,9 @@ class IMP_Session
         }
 
         if ($init_url == 'folders.php') {
-            $url = Horde_Util::addParameter(Horde::applicationUrl($init_url, !$encode), array_merge(array('folders_token' => IMP::getRequestToken('imp.folders')), IMP::getComposeArgs()), null, $encode);
+            $url = Horde_Util::addParameter(Horde::applicationUrl($init_url, !$encode), array_merge(array('folders_token' => Horde::getRequestToken('imp.folders')), IMP::getComposeArgs()), null, $encode);
         } else {
-            $url = Horde_Util::addParameter(Horde::applicationUrl('mailbox.php', !$encode), array_merge(array('mailbox' => $init_url, 'mailbox_token' => IMP::getRequestToken('imp.mailbox')), IMP::getComposeArgs()), null, $encode);
+            $url = Horde_Util::addParameter(Horde::applicationUrl('mailbox.php', !$encode), array_merge(array('mailbox' => $init_url, 'mailbox_token' => Horde::getRequestToken('imp.mailbox')), IMP::getComposeArgs()), null, $encode);
         }
 
         if (!empty($actionID)) {

diff --git a/imp/mailbox.php b/imp/mailbox.php
index a4025fb..b12b1d4 100644 (file)
--- a/imp/mailbox.php
+++ b/imp/mailbox.php
@@ -84,7 +84,7 @@ $open_compose_window = null;
 /* Run through the action handlers */
 if ($actionID && ($actionID != 'message_missing')) {
     try {
-        IMP::checkRequestToken('imp.mailbox', Horde_Util::getFormData('mailbox_token'));
+        Horde::checkRequestToken('imp.mailbox', Horde_Util::getFormData('mailbox_token'));
     } catch (Horde_Exception $e) {
         $notification->push($e);
         $actionID = null;
@@ -210,7 +210,7 @@ case 'login_compose':
 }
 
 /* Token to use in requests */
-$mailbox_token = IMP::getRequestToken('imp.mailbox');
+$mailbox_token = Horde::getRequestToken('imp.mailbox');
 
 /* Deal with filter options. */
 if (!$readonly && !empty($_SESSION['imp']['filteravail'])) {

diff --git a/imp/message-mimp.php b/imp/message-mimp.php
index b7e020e..f5d3ec3 100644 (file)
--- a/imp/message-mimp.php
+++ b/imp/message-mimp.php
@@ -55,7 +55,7 @@ case 'u':
         $imp_message->undelete($indices_array);
     } else {
         try {
-            IMP::checkRequestToken('imp.message-mimp', Horde_Util::getFormData('mt'));
+            Horde::checkRequestToken('imp.message-mimp', Horde_Util::getFormData('mt'));
             $imp_message->delete($indices_array);
             if ($prefs->getValue('mailbox_return')) {
                 header('Location: ' . Horde_Util::addParameter(IMP::generateIMPUrl('mailbox-mimp.php', $imp_mbox['mailbox']), array('s' => $imp_mailbox->getMessageIndex()), null, false));
@@ -301,7 +301,7 @@ if (!$readonly) {
     if (in_array('\\deleted', $flags)) {
         $mset->add(new Horde_Mobile_link(_("Undelete"), Horde_Util::addParameter($self_link, array('a' => 'u'))));
     } else {
-        $mset->add(new Horde_Mobile_link(_("Delete"), Horde_Util::addParameter($self_link, array('a' => 'd', 'mt' => IMP::getRequestToken('imp.message-mimp')))));
+        $mset->add(new Horde_Mobile_link(_("Delete"), Horde_Util::addParameter($self_link, array('a' => 'd', 'mt' => Horde::getRequestToken('imp.message-mimp')))));
     }
 }
 

diff --git a/imp/message.php b/imp/message.php
index c552d08..0733b30 100644 (file)
--- a/imp/message.php
+++ b/imp/message.php
@@ -57,7 +57,7 @@ $user_identity = &Identity::singleton(array('imp', 'imp'));
 $actionID = Horde_Util::getFormData('actionID');
 if ($actionID && ($actionID != 'print_message')) {
     try {
-        IMP::checkRequestToken('imp.message', Horde_Util::getFormData('message_token'));
+        Horde::checkRequestToken('imp.message', Horde_Util::getFormData('message_token'));
     } catch (Horde_Exception $e) {
         $notification->push($e);
         $actionID = null;
@@ -181,7 +181,7 @@ case 'strip_attachment':
 }
 
 /* Token to use in requests */
-$message_token = IMP::getRequestToken('imp.message');
+$message_token = Horde::getRequestToken('imp.message');
 
 /* We may have done processing that has taken us past the end of the
  * message array, so we will return to mailbox.php if that is the

diff --git a/imp/thread.php b/imp/thread.php
index 0dddaf0..70910cf 100644 (file)
--- a/imp/thread.php
+++ b/imp/thread.php
@@ -151,7 +151,7 @@ if ($mode == 'thread') {
         IMP::generateIMPUrl('mailbox.php', $mbox),
         array('start' => $imp_mailbox->getArrayIndex($idx),
               'actionID' => 'delete_messages',
-              'mailbox_token' => IMP::getRequestToken('imp.mailbox')));
+              'mailbox_token' => Horde::getRequestToken('imp.mailbox')));
     foreach ($thread as $val) {
         $delete_link = Horde_Util::addParameter(
             $delete_link,