From 58e871fd57002fc788317dfb765c320d9c9ad5a3 Mon Sep 17 00:00:00 2001 From: Michael M Slusarz Date: Sun, 28 Jun 2009 23:28:51 -0600 Subject: [PATCH] Use Horde:: equivalents for token checking. --- imp/compose.php | 6 +++--- imp/config/conf.xml | 4 ---- imp/folders.php | 6 +++--- imp/lib/Contents.php | 2 +- imp/lib/IMP.php | 33 --------------------------------- imp/lib/Search.php | 2 +- imp/lib/Session.php | 4 ++-- imp/mailbox.php | 4 ++-- imp/message-mimp.php | 4 ++-- imp/message.php | 4 ++-- imp/thread.php | 2 +- 11 files changed, 17 insertions(+), 54 deletions(-) diff --git a/imp/compose.php b/imp/compose.php index 142d6af23..238652b48 100644 --- a/imp/compose.php +++ b/imp/compose.php @@ -104,7 +104,7 @@ if ($actionID) { default: try { - IMP::checkRequestToken('imp.compose', Horde_Util::getFormData('compose_requestToken')); + Horde::checkRequestToken('imp.compose', Horde_Util::getFormData('compose_requestToken')); } catch (Horde_Exception $e) { $notification->push($e); $actionID = null; @@ -818,7 +818,7 @@ if ($redirect) { $t->set('index', htmlspecialchars($index)); $t->set('status', Horde_Util::bufferOutput(array('IMP', 'status'))); $t->set('title', htmlspecialchars($title)); - $t->set('token', IMP::getRequestToken('imp.compose')); + $t->set('token', Horde::getRequestToken('imp.compose')); if ($registry->hasMethod('contacts/search')) { $t->set('has_search', true); @@ -878,7 +878,7 @@ if ($redirect) { $hidden = array( 'actionID' => '', 'user' => $_SESSION['imp']['uniquser'], - 'compose_requestToken' => IMP::getRequestToken('imp.compose'), + 'compose_requestToken' => Horde::getRequestToken('imp.compose'), 'compose_formToken' => Horde_Token::generateId('compose'), 'composeCache' => $composeCacheID, 'mailbox' => htmlspecialchars($imp_mbox['mailbox']), diff --git a/imp/config/conf.xml b/imp/config/conf.xml index 8a37f2bd8..d90087548 100644 --- a/imp/config/conf.xml +++ b/imp/config/conf.xml @@ -135,10 +135,6 @@ next login. If IMP will be the exclusive means of accessing the mail server, or you are not concerned about this behavior, this setting should be set to true.">true - 1800 none diff --git a/imp/folders.php b/imp/folders.php index 9cbf20943..90a82e801 100644 --- a/imp/folders.php +++ b/imp/folders.php @@ -79,7 +79,7 @@ $open_compose_window = null; $actionID = Horde_Util::getFormData('actionID'); if ($actionID) { try { - IMP::checkRequestToken('imp.folders', Horde_Util::getFormData('folders_token')); + Horde::checkRequestToken('imp.folders', Horde_Util::getFormData('folders_token')); } catch (Horde_Exception $e) { $notification->push($e); $actionID = null; @@ -275,7 +275,7 @@ case 'folders_empty_mailbox_confirm': $template->set('empty', ($actionID == 'folders_empty_mailbox_confirm')); $template->set('folders', $loop); $template->set('folders_url', $folders_url); - $template->set('folders_token', IMP::getRequestToken('imp.folders')); + $template->set('folders_token', Horde::getRequestToken('imp.folders')); echo $template->fetch(IMP_TEMPLATES . '/folders/folders_confirm.html'); require $registry->get('templates', 'horde') . '/common-footer.inc'; @@ -324,7 +324,7 @@ case 'mbox_size': } /* Token to use in requests */ -$folders_token = IMP::getRequestToken('imp.folders'); +$folders_token = Horde::getRequestToken('imp.folders'); $folders_url = Horde_Util::addParameter($folders_url, 'folders_token', $folders_token); diff --git a/imp/lib/Contents.php b/imp/lib/Contents.php index 0f341fa9d..3fa4dc30c 100644 --- a/imp/lib/Contents.php +++ b/imp/lib/Contents.php @@ -624,7 +624,7 @@ class IMP_Contents (intval($id) != 1) && (strpos($id, '.') === false)) { $url = Horde_Util::removeParameter(Horde::selfUrl(true), array('actionID', 'imapid', 'index')); - $url = Horde_Util::addParameter($url, array('actionID' => 'strip_attachment', 'imapid' => $id, 'index' => $this->_index, 'message_token' => IMP::getRequestToken('imp.impcontents'))); + $url = Horde_Util::addParameter($url, array('actionID' => 'strip_attachment', 'imapid' => $id, 'index' => $this->_index, 'message_token' => Horde::getRequestToken('imp.impcontents'))); $part['strip'] = Horde::link($url, _("Strip Attachment"), 'stripAtc', null, "return window.confirm('" . addslashes(_("Are you sure you wish to PERMANENTLY delete this attachment?")) . "');") . ''; } diff --git a/imp/lib/IMP.php b/imp/lib/IMP.php index a78e5b276..7b6877dc5 100644 --- a/imp/lib/IMP.php +++ b/imp/lib/IMP.php @@ -94,39 +94,6 @@ class IMP } /** - * Get a token for protecting a form. - * - * @param string $slug TODO - * - * @return TODO - */ - static public function getRequestToken($slug) - { - $token = Horde_Token::generateId($slug); - $_SESSION['horde_form_secrets'][$token] = time(); - return $token; - } - - /** - * Check if a token for a form is valid. - * - * @param string $slug TODO - * @param string $token TODO - * - * @throws Horde_Exception - */ - static public function checkRequestToken($slug, $token) - { - if (empty($_SESSION['horde_form_secrets'][$token])) { - throw new Horde_Exception(_("We cannot verify that this request was really sent by you. It could be a malicious request. If you intended to perform this action, you can retry it now.")); - } - - if ($_SESSION['horde_form_secrets'][$token] + $GLOBALS['conf']['server']['token_lifetime'] < time()) { - throw new Horde_Exception(sprintf(_("This request cannot be completed because the link you followed or the form you submitted was only valid for %d minutes. Please try again now."), round($GLOBALS['conf']['server']['token_lifetime'] / 60))); - } - } - - /** * Returns the plain text label that is displayed for the current mailbox, * replacing virtual search mailboxes with an appropriate description and * removing namespace and mailbox prefix information from what is shown to diff --git a/imp/lib/Search.php b/imp/lib/Search.php index ba2fa3e8c..66f11777c 100644 --- a/imp/lib/Search.php +++ b/imp/lib/Search.php @@ -605,7 +605,7 @@ class IMP_Search $id = $this->_strip($id); return Horde_Util::addParameter(Horde::applicationUrl('folders.php'), array('actionID' => 'delete_search_query', - 'folders_token' => IMP::getRequestToken('imp.folders'), + 'folders_token' => Horde::getRequestToken('imp.folders'), 'queryid' => $id, )); } diff --git a/imp/lib/Session.php b/imp/lib/Session.php index c1c9f2664..d4905cb51 100644 --- a/imp/lib/Session.php +++ b/imp/lib/Session.php @@ -352,9 +352,9 @@ class IMP_Session } if ($init_url == 'folders.php') { - $url = Horde_Util::addParameter(Horde::applicationUrl($init_url, !$encode), array_merge(array('folders_token' => IMP::getRequestToken('imp.folders')), IMP::getComposeArgs()), null, $encode); + $url = Horde_Util::addParameter(Horde::applicationUrl($init_url, !$encode), array_merge(array('folders_token' => Horde::getRequestToken('imp.folders')), IMP::getComposeArgs()), null, $encode); } else { - $url = Horde_Util::addParameter(Horde::applicationUrl('mailbox.php', !$encode), array_merge(array('mailbox' => $init_url, 'mailbox_token' => IMP::getRequestToken('imp.mailbox')), IMP::getComposeArgs()), null, $encode); + $url = Horde_Util::addParameter(Horde::applicationUrl('mailbox.php', !$encode), array_merge(array('mailbox' => $init_url, 'mailbox_token' => Horde::getRequestToken('imp.mailbox')), IMP::getComposeArgs()), null, $encode); } if (!empty($actionID)) { diff --git a/imp/mailbox.php b/imp/mailbox.php index a4025fbfe..b12b1d49c 100644 --- a/imp/mailbox.php +++ b/imp/mailbox.php @@ -84,7 +84,7 @@ $open_compose_window = null; /* Run through the action handlers */ if ($actionID && ($actionID != 'message_missing')) { try { - IMP::checkRequestToken('imp.mailbox', Horde_Util::getFormData('mailbox_token')); + Horde::checkRequestToken('imp.mailbox', Horde_Util::getFormData('mailbox_token')); } catch (Horde_Exception $e) { $notification->push($e); $actionID = null; @@ -210,7 +210,7 @@ case 'login_compose': } /* Token to use in requests */ -$mailbox_token = IMP::getRequestToken('imp.mailbox'); +$mailbox_token = Horde::getRequestToken('imp.mailbox'); /* Deal with filter options. */ if (!$readonly && !empty($_SESSION['imp']['filteravail'])) { diff --git a/imp/message-mimp.php b/imp/message-mimp.php index b7e020eef..f5d3ec3a9 100644 --- a/imp/message-mimp.php +++ b/imp/message-mimp.php @@ -55,7 +55,7 @@ case 'u': $imp_message->undelete($indices_array); } else { try { - IMP::checkRequestToken('imp.message-mimp', Horde_Util::getFormData('mt')); + Horde::checkRequestToken('imp.message-mimp', Horde_Util::getFormData('mt')); $imp_message->delete($indices_array); if ($prefs->getValue('mailbox_return')) { header('Location: ' . Horde_Util::addParameter(IMP::generateIMPUrl('mailbox-mimp.php', $imp_mbox['mailbox']), array('s' => $imp_mailbox->getMessageIndex()), null, false)); @@ -301,7 +301,7 @@ if (!$readonly) { if (in_array('\\deleted', $flags)) { $mset->add(new Horde_Mobile_link(_("Undelete"), Horde_Util::addParameter($self_link, array('a' => 'u')))); } else { - $mset->add(new Horde_Mobile_link(_("Delete"), Horde_Util::addParameter($self_link, array('a' => 'd', 'mt' => IMP::getRequestToken('imp.message-mimp'))))); + $mset->add(new Horde_Mobile_link(_("Delete"), Horde_Util::addParameter($self_link, array('a' => 'd', 'mt' => Horde::getRequestToken('imp.message-mimp'))))); } } diff --git a/imp/message.php b/imp/message.php index c552d087b..0733b3087 100644 --- a/imp/message.php +++ b/imp/message.php @@ -57,7 +57,7 @@ $user_identity = &Identity::singleton(array('imp', 'imp')); $actionID = Horde_Util::getFormData('actionID'); if ($actionID && ($actionID != 'print_message')) { try { - IMP::checkRequestToken('imp.message', Horde_Util::getFormData('message_token')); + Horde::checkRequestToken('imp.message', Horde_Util::getFormData('message_token')); } catch (Horde_Exception $e) { $notification->push($e); $actionID = null; @@ -181,7 +181,7 @@ case 'strip_attachment': } /* Token to use in requests */ -$message_token = IMP::getRequestToken('imp.message'); +$message_token = Horde::getRequestToken('imp.message'); /* We may have done processing that has taken us past the end of the * message array, so we will return to mailbox.php if that is the diff --git a/imp/thread.php b/imp/thread.php index 0dddaf0e1..70910cf83 100644 --- a/imp/thread.php +++ b/imp/thread.php @@ -151,7 +151,7 @@ if ($mode == 'thread') { IMP::generateIMPUrl('mailbox.php', $mbox), array('start' => $imp_mailbox->getArrayIndex($idx), 'actionID' => 'delete_messages', - 'mailbox_token' => IMP::getRequestToken('imp.mailbox'))); + 'mailbox_token' => Horde::getRequestToken('imp.mailbox'))); foreach ($thread as $val) { $delete_link = Horde_Util::addParameter( $delete_link, -- 2.11.0