Another problem with "search results expired"

[Neil Hoggarth]

I have found another code path which can give rise to the "ERROR - This
page request could not be verified and appears to have expired" problem
in src/search.php, in both 1.4.20-RC2 and SM-1_4-STABLE SVN branch.

To reproduce:

1. Perform a search.

2. Select a message from the search results (taking us to
    src/read_body.php).

3  Click the "Delete" link above the message headers (taking us to
    src/delete_message.php, with a valid smtoken).

4. src/delete_message.php does delete the message, but then generates a
    redirect to src/search.php without including an smtoken in the URL.

Proposed patch, which seems to fix things for our installation (diff -u
against SM-1_4-STABLE branch, r13840):

--- src/delete_message.php~ 2009-09-18 13:58:23.000000000 +0100
+++ src/delete_message.php 2009-09-18 13:58:46.000000000 +0100
@@ -78,6 +78,7 @@

  if (isset($where) && isset($what)) {
      header("Location: $location/search.php?where=" . $where .
+           '&smtoken=' . sm_generate_security_token() .
             '&what=' . $what . '&mailbox=' . urlencode($mailbox));
  } else {
      if (!empty($saved_draft) || !empty($mail_sent)) {


Regards,
--
Neil Hoggarth -------------- Department of Physiology, Anatomy and Genetics
Head of IT --------------------------------------- University of Oxford, UK


------------------------------------------------------------------------------
Come build with us! The BlackBerry® Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9-12, 2009. Register now!
http://p.sf.net/sfu/devconf
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel

[Jon Angliss]

On Fri, 18 Sep 2009 14:22:49 +0100 (BST), Neil Hoggarth
<neil.hoggarth@...> wrote:

>I have found another code path which can give rise to the "ERROR - This
>page request could not be verified and appears to have expired" problem
>in src/search.php, in both 1.4.20-RC2 and SM-1_4-STABLE SVN branch.

Confirmed, patched, committed.

Thanks
--
Jonathan Angliss
<jon@...>


------------------------------------------------------------------------------
Come build with us! The BlackBerry® Developer Conference in SF, CA
is the only developer event you need to attend this year. Jumpstart your
developing skills, take BlackBerry mobile applications to market and stay
ahead of the curve. Join us from November 9-12, 2009. Register now!
http://p.sf.net/sfu/devconf
-----
squirrelmail-devel mailing list
Posting guidelines: http://squirrelmail.org/postingguidelines
List address: squirrelmail-devel@...
List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel
List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel