Tickets :: Comment on [#10722] "cannot verify" error message on stripping attachments

* Your Email Address
* Spam protection	Enter the letters below: .__ .___._. .. , [ __[__ \| \| \./ [_./[____\|_\__\| \|
Comment	> In the Traditional mode of IMP, when selecting "Strip Attachment" > users are presented with: > > "We cannot verify that this request was really sent by you. It could > be a malicious request. If you intended to perform this action, you > can retry it now." > > This appears to be because in imp/lib/Contents.php the seed if for > imp.impcontents, yet message.php validates "imp.message" when > checking the actionID > > The bug fix we put in place in message.php in the try block was: > > + ($vars->actionID == 'strip_attachment') ? > + $injector->getInstance('Horde_Token')->validate($vars->message_token, > 'imp.impcontents') : > $injector->getInstance('Horde_Token')->validate($vars->message_token, > 'imp.message'); > > I hope this doesn't affect the code adversely in other ways. I > suspect lib/Contents.php should really be modified instead.
Attachment
Watch this ticket