search results expired?
|
View:
New views
8 Messages
—
Rating Filter:
Alert me
|
 |
search results expired?
by Ralf Hildebrandt
::
Rate this Message:
Hi there!
With 1.4.20RC1 I'm getting this error: * search for anything using the "Search" link (e.g. Subject contains "test") * I'm getting several results back * I'm choosing a mail at random, and have it displayed * I decide it's the wrong one and go back to the list of search results by clicking on the link labeled "Search results" which leads me to: https://webmail.example.com/squirrelmail/src/search.php?where=SUBJECT&what=test&mailbox=INBOX.Sent * I'm getting an error page in the right frame: "This page request could not be verified and appears to have expired." Could this be related to the recent changes in rc1 which are supposed to foil cross site scripting? -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt@... | http://www.charite.de ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel@... List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel |
|
|
[Regression] search results expired?
by Ralf Hildebrandt
::
Rate this Message:
* Ralf Hildebrandt <Ralf.Hildebrandt@...>:
> Hi there! > > With 1.4.20RC1 I'm getting this error: > > * search for anything using the "Search" link (e.g. Subject contains "test") > * I'm getting several results back > * I'm choosing a mail at random, and have it displayed > * I decide it's the wrong one and go back to the list of search results by > clicking on the link labeled "Search results" which leads me to: > https://webmail.example.com/squirrelmail/src/search.php?where=SUBJECT&what=test&mailbox=INBOX.Sent > * I'm getting an error page in the right frame: > "This page request could not be verified and appears to have expired." > > Could this be related to the recent changes in rc1 which are supposed > to foil cross site scripting? I tried 1.4.19, it doesn't show that particular behaviour! -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt@... | http://www.charite.de ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel@... List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel |
|
|
Re: [Regression] search results expired?
by Jon Angliss
::
Rate this Message:
On Sun, 30 Aug 2009 14:28:31 +0200, Ralf Hildebrandt
<Ralf.Hildebrandt@...> wrote: >* Ralf Hildebrandt <Ralf.Hildebrandt@...>: >> Hi there! >> >> With 1.4.20RC1 I'm getting this error: >> >> * search for anything using the "Search" link (e.g. Subject contains "test") >> * I'm getting several results back >> * I'm choosing a mail at random, and have it displayed >> * I decide it's the wrong one and go back to the list of search results by >> clicking on the link labeled "Search results" which leads me to: >> https://webmail.example.com/squirrelmail/src/search.php?where=SUBJECT&what=test&mailbox=INBOX.Sent >> * I'm getting an error page in the right frame: >> "This page request could not be verified and appears to have expired." >> >> Could this be related to the recent changes in rc1 which are supposed >> to foil cross site scripting? > >I tried 1.4.19, it doesn't show that particular behaviour! That would be because of some new improved security. Thanks for the catch. http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13833 src/read_body.php is really the only change I can see you needing for this issue. I did notice that the token validation only looked for GET whilst it passed in a post too, so I made a little change there in src/search.php as well. -- Jonathan Angliss <jon@...> ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel@... List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel |
|
|
Re: [Regression] search results expired?
by Paul Lesniewski
::
Rate this Message:
On Sun, Aug 30, 2009 at 4:55 PM, Jonathan Angliss<jon@...> wrote:
> On Sun, 30 Aug 2009 14:28:31 +0200, Ralf Hildebrandt > <Ralf.Hildebrandt@...> wrote: > >>* Ralf Hildebrandt <Ralf.Hildebrandt@...>: >>> Hi there! >>> >>> With 1.4.20RC1 I'm getting this error: >>> >>> * search for anything using the "Search" link (e.g. Subject contains "test") >>> * I'm getting several results back >>> * I'm choosing a mail at random, and have it displayed >>> * I decide it's the wrong one and go back to the list of search results by >>> clicking on the link labeled "Search results" which leads me to: >>> https://webmail.example.com/squirrelmail/src/search.php?where=SUBJECT&what=test&mailbox=INBOX.Sent >>> * I'm getting an error page in the right frame: >>> "This page request could not be verified and appears to have expired." >>> >>> Could this be related to the recent changes in rc1 which are supposed >>> to foil cross site scripting? >> >>I tried 1.4.19, it doesn't show that particular behaviour! > > That would be because of some new improved security. Thanks for the > catch. > > http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13833 > > src/read_body.php is really the only change I can see you needing for > this issue. I did notice that the token validation only looked for > GET whilst it passed in a post too, so I made a little change there in > src/search.php as well. There are no forms using POST that point to src/search.php that I know of. I switched it back. -- Paul Lesniewski SquirrelMail Team Please support Open Source Software by donating to SquirrelMail! http://squirrelmail.org/donate_paul_lesniewski.php ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel@... List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel |
|
|
Re: [Regression] search results expired?
by Ralf Hildebrandt
::
Rate this Message:
* Paul Lesniewski <paul@...>:
> > That would be because of some new improved security. Thanks for the > > catch. > > > > http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13833 > > > > src/read_body.php is really the only change I can see you needing for > > this issue. I did notice that the token validation only looked for > > GET whilst it passed in a post too, so I made a little change there in > > src/search.php as well. > > There are no forms using POST that point to src/search.php that I know > of. I switched it back. Uhm, so what I the patch I need to apply? -- Ralf Hildebrandt Geschäftsbereich IT | Abteilung Netzwerk Charité - Universitätsmedizin Berlin Campus Benjamin Franklin Hindenburgdamm 30 | D-12203 Berlin Tel. +49 30 450 570 155 | Fax: +49 30 450 570 962 ralf.hildebrandt@... | http://www.charite.de ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel@... List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel |
|
|
Re: [Regression] search results expired?
by Paul Lesniewski
::
Rate this Message:
On Mon, Aug 31, 2009 at 12:39 AM, Ralf
Hildebrandt<Ralf.Hildebrandt@...> wrote: > * Paul Lesniewski <paul@...>: > >> > That would be because of some new improved security. Thanks for the >> > catch. >> > >> > http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13833 >> > >> > src/read_body.php is really the only change I can see you needing for >> > this issue. I did notice that the token validation only looked for >> > GET whilst it passed in a post too, so I made a little change there in >> > src/search.php as well. >> >> There are no forms using POST that point to src/search.php that I know >> of. I switched it back. > > Uhm, so what I the patch I need to apply? You can apply all of Jon's patch without harm, but if you want to stay in sync with what will be 1.4.20, don't apply the part of his patch against src/search.php -- Paul Lesniewski SquirrelMail Team Please support Open Source Software by donating to SquirrelMail! http://squirrelmail.org/donate_paul_lesniewski.php ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel@... List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel |
|
|
Re: [Regression] search results expired?
by Jon Angliss
::
Rate this Message:
On Sun, 30 Aug 2009 20:44:17 -0700, Paul Lesniewski
<paul@...> wrote: >On Sun, Aug 30, 2009 at 4:55 PM, Jonathan Angliss<jon@...> wrote: >> On Sun, 30 Aug 2009 14:28:31 +0200, Ralf Hildebrandt >> <Ralf.Hildebrandt@...> wrote: >> >>>* Ralf Hildebrandt <Ralf.Hildebrandt@...>: >>>> Hi there! >>>> >>>> With 1.4.20RC1 I'm getting this error: >>>> >>>> * search for anything using the "Search" link (e.g. Subject contains "test") >>>> * I'm getting several results back >>>> * I'm choosing a mail at random, and have it displayed >>>> * I decide it's the wrong one and go back to the list of search results by >>>> clicking on the link labeled "Search results" which leads me to: >>>> https://webmail.example.com/squirrelmail/src/search.php?where=SUBJECT&what=test&mailbox=INBOX.Sent >>>> * I'm getting an error page in the right frame: >>>> "This page request could not be verified and appears to have expired." >>>> >>>> Could this be related to the recent changes in rc1 which are supposed >>>> to foil cross site scripting? >>> >>>I tried 1.4.19, it doesn't show that particular behaviour! >> >> That would be because of some new improved security. Thanks for the >> catch. >> >> http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13833 >> >> src/read_body.php is really the only change I can see you needing for >> this issue. I did notice that the token validation only looked for >> GET whilst it passed in a post too, so I made a little change there in >> src/search.php as well. > >There are no forms using POST that point to src/search.php that I know >of. I switched it back. src/search.php posts to src/search.php. That being said, there is actually no method defined, so I guess the browser falls back to GET instead? Interesting, wonder why that was done. -- Jonathan Angliss <jon@...> ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel@... List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel |
|
|
Re: [Regression] search results expired?
by Paul Lesniewski
::
Rate this Message:
On Mon, Aug 31, 2009 at 6:35 PM, Jonathan Angliss<jon@...> wrote:
> On Sun, 30 Aug 2009 20:44:17 -0700, Paul Lesniewski > <paul@...> wrote: > >>On Sun, Aug 30, 2009 at 4:55 PM, Jonathan Angliss<jon@...> wrote: >>> On Sun, 30 Aug 2009 14:28:31 +0200, Ralf Hildebrandt >>> <Ralf.Hildebrandt@...> wrote: >>> >>>>* Ralf Hildebrandt <Ralf.Hildebrandt@...>: >>>>> Hi there! >>>>> >>>>> With 1.4.20RC1 I'm getting this error: >>>>> >>>>> * search for anything using the "Search" link (e.g. Subject contains "test") >>>>> * I'm getting several results back >>>>> * I'm choosing a mail at random, and have it displayed >>>>> * I decide it's the wrong one and go back to the list of search results by >>>>> clicking on the link labeled "Search results" which leads me to: >>>>> https://webmail.example.com/squirrelmail/src/search.php?where=SUBJECT&what=test&mailbox=INBOX.Sent >>>>> * I'm getting an error page in the right frame: >>>>> "This page request could not be verified and appears to have expired." >>>>> >>>>> Could this be related to the recent changes in rc1 which are supposed >>>>> to foil cross site scripting? >>>> >>>>I tried 1.4.19, it doesn't show that particular behaviour! >>> >>> That would be because of some new improved security. Thanks for the >>> catch. >>> >>> http://squirrelmail.svn.sourceforge.net/viewvc/squirrelmail?view=rev&revision=13833 >>> >>> src/read_body.php is really the only change I can see you needing for >>> this issue. I did notice that the token validation only looked for >>> GET whilst it passed in a post too, so I made a little change there in >>> src/search.php as well. >> >>There are no forms using POST that point to src/search.php that I know >>of. I switched it back. > > src/search.php posts to src/search.php. That being said, there is > actually no method defined, so I guess the browser falls back to GET Yeah > instead? Interesting, wonder why that was done. Probably so the "back to results" kind of links can be that: lnks and not forms -- Paul Lesniewski SquirrelMail Team Please support Open Source Software by donating to SquirrelMail! http://squirrelmail.org/donate_paul_lesniewski.php ------------------------------------------------------------------------------ Let Crystal Reports handle the reporting - Free Crystal Reports 2008 30-Day trial. Simplify your report design, integration and deployment - and focus on what you do best, core application coding. Discover what's new with Crystal Reports now. http://p.sf.net/sfu/bobj-july ----- squirrelmail-devel mailing list Posting guidelines: http://squirrelmail.org/postingguidelines List address: squirrelmail-devel@... List archives: http://news.gmane.org/gmane.mail.squirrelmail.devel List info (subscribe/unsubscribe/change options): https://lists.sourceforge.net/lists/listinfo/squirrelmail-devel |
| Free embeddable forum powered by Nabble | Forum Help |
