Fix test for signout.php in the logged in check in init.php so it

cannot be circumvented by manipulating the URL. External plugins migh
rely on init.php guarranteeing that the user is logged in.
Thanks Stefan Esser for finding this.

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@12528 7612ce4b-ef26-0410-bec9-ea0150e637f0

diff --git a/ChangeLog b/ChangeLog
index 0127e344b1c58bec24ac93da5bf490545416359d..285324279197d86ca15e34230ea467ebac7376bf 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -201,9 +201,12 @@ Version 1.5.2 - SVN
     images. Thanks to Mikhail Markin, Tomas Kuliavas and Michael Jordon
     for reporting these issues. [CVE-2007-1262]
   - Fix busy loop and notice when two literals in IMAP fetch (#1739433).
-  - Resolved issue with compose session not being updated after send/safe.
+  - Resolved issue with compose session not being updated after send/save.
   - Added ability to detect HTTP_X_FORWARDED_PROTO in get_location(),
-    thanks to Daniel Watts
+    thanks to Daniel Watts.
+  - Fix test for signout.php in the logged in check in init.php so it
+    cannot be circumvented by manipulating the URL. External plugins migh
+    rely on init.php guarranteeing that the user is logged in.
 
 Version 1.5.1 (branched on 2006-02-12)
 --------------------------------------

diff --git a/include/init.php b/include/init.php
index a06084b58558a20b8f9b2aee902e2dc499812614..916bbcc9b3e3ecd35b79bd701b5cc40dfe1c3a49 100644 (file)
--- a/include/init.php
+++ b/include/init.php
@@ -417,8 +417,8 @@ switch ($sInitLocation) {
             // signout page will deal with users who aren't logged
             // in on its own; don't show error here
             //
-            if (strpos($PHP_SELF, 'signout.php') !== FALSE) {
-            return;
+            if ( defined('PAGE_SIGNOUT') ) {
+                return;
             }
 
             /**

diff --git a/src/signout.php b/src/signout.php
index 37e5a2d6fb33863e84e045cb56668f2a81d8d8ce..606a050a6906fe40c90499a647fd42976fc30043 100644 (file)
--- a/src/signout.php
+++ b/src/signout.php
@@ -11,6 +11,9 @@
  * @package squirrelmail
  */
 
+/** This is the signout page */
+define('PAGE_SIGNOUT', 1);
+
 /**
  * Include the SquirrelMail initialization file.
  */