Changeset 293 for trunk/lib

Timestamp:

Dec 11, 2007 10:53:46 PM (16 years ago)

Author:

quinn

Message:

Minor updates.

Location:

trunk/lib

Files:

• App.inc.php (modified) (1 diff)
• Email.inc.php (modified) (1 diff)

trunk/lib/App.inc.php

@@ -65 +65 @@
         'session_name' => '_session',
         'session_use_cookies' => true,
+        
+        // Pass the session-id through URLs if cookies are not enabled?
+        // Disable this to prevent session ID theft.
         'session_use_trans_sid' => false,
 

trunk/lib/Email.inc.php

@@ -303 +303 @@
         // Check for mail header injection attacks.
         $full_mail_content = join($this->getParam('crlf'), array($final_to, $this->_params['subject'], $final_body));
-        if (preg_match("/(^|[\n\r])(Content-Type|MIME-Version|Content-Transfer-Encoding|Bcc|Cc):/i", $full_mail_content)) {
+        if (preg_match("/(^|[\n\r])(Content-Type|MIME-Version|Content-Transfer-Encoding|Bcc|Cc)\s*:/i", $full_mail_content)) {
             $app->logMsg(sprintf('Mail header injection attack in content: %s', $full_mail_content), LOG_WARNING, __FILE__, __LINE__);
             sleep(3);