Tickets :: Comment on [#7756] checkRequestToken in Horde.php -> all tokens are only valid for 0min

* Your Email Address
* Spam protection	Enter the letters below: . .__..__..__.. . \| \| \|\| \|\| \|\|\ \| \|___\|__\|\|__\\|__\|\| \\|
Comment	> There is a math bug in the Horde.php checkRequestToken, the > paranthesis are missing : > > > > instead of > > > > if ($_SESSION['horde_form_secrets'][$token] + > $GLOBALS['conf']['urls']['token_lifetime'] * 60 < time()) { > > return PEAR::raiseError(sprintf(_("This request cannot be > completed because the link you followed or the form you submitted was > only valid for %s minutes"), > $GLOBALS['conf']['urls']['token_lifetime'])); > > } > > > > > > it should be > > > > if (($_SESSION['horde_form_secrets'][$token] + > $GLOBALS['conf']['urls']['token_lifetime']) * 60 < time()) { > > return PEAR::raiseError(sprintf(_("This request cannot be > completed because the link you followed or the form you submitted was > only valid for %s minutes"), > $GLOBALS['conf']['urls']['token_lifetime'])); > > } > > > > no matter which setting you chose for token_lifetime - it will always > complain about that the link is no longer valid.
Attachment
Watch this ticket