X-Git-Url: https://vcs.fsf.org/?p=squirrelmail.git;a=blobdiff_plain;f=config%2Fconfig_default.php;h=654c0eda6858fa6a3029fd41dfdbeeb389803181;hp=56f48cfbddde24960f3d01bb4c59527bf4648828;hb=821d1f1424ce74d60ae3b6e357a148658f17424e;hpb=8f557b942c5a3fb6663c349f4cc7d4a1c8aa4504 diff --git a/config/config_default.php b/config/config_default.php index 56f48cfb..654c0eda 100644 --- a/config/config_default.php +++ b/config/config_default.php @@ -15,7 +15,7 @@ * passwords being leaked to e.g. other system users. Take extra care when * the webserver is shared with untrusted users. * - * @copyright © 2000-2007 The SquirrelMail Project Team + * @copyright 2000-2012 The SquirrelMail Project Team * @license http://opensource.org/licenses/gpl-license.php GNU Public License * @version $Id$ * @package squirrelmail @@ -673,6 +673,53 @@ $allow_advanced_search = 0; */ $session_name = 'SQMSESSID'; +/** + * Secure Cookies + * + * Only transmit cookies via a secure connection + * if the session was started using HTTPS/SSL? + * + * Highly recommended + * + * @global bool $only_secure_cookies + * @since 1.5.2 and 1.4.16 + */ +$only_secure_cookies = true; + +/** + * Secure Forms + * + * Disable security tokens used to authenticate the + * source of user data received by SquirrelMail? + * + * It is highly discouraged to enable this setting. + * + * @global bool $disable_security_tokens + * @since 1.5.2 and 1.4.20RC1 + */ +$disable_security_tokens = false; + +/** + * Check Page Referrer + * + * Enforces a safety check on page requests by checking + * that the referrer is the domain specified by this + * setting. If this setting is "###DOMAIN###", the + * current value of the $domain variable will be used + * for the check. + * + * If a browser doesn't send referrer data, this check + * will be silently bypassed. + * + * Examples: + * $check_referrer = 'example.com'; + * $check_referrer = '###DOMAIN###'; + * + * @global string $check_referrer + * @since 1.5.2 and 1.4.20RC1 + */ +$check_referrer = ''; + /** * User Themes