roundcubemail/program/lib/Roundcube/rcube.php
public function check_request($mode = rcube_utils::INPUT_POST)
    {
        // check secure token in URL if enabled
        if ($token = $this->get_secure_url_token()) {
            foreach (explode('/', preg_replace('/[?#&].*$/', '', $_SERVER['REQUEST_URI'])) as $tok) {
                if ($tok == $token) {
                    return true;
                }
            }

            $this->request_status = self::REQUEST_ERROR_URL;

            return false;
        }

        $sess_tok = $this->get_request_token();

        // ajax requests
        if (rcube_utils::request_header('X-Roundcube-Request') === $sess_tok) {
            return true;
        }

        // skip empty requests
        if (($mode == rcube_utils::INPUT_POST && empty($_POST))
            || ($mode == rcube_utils::INPUT_GET && empty($_GET))
        ) {
            return true;
        }

        // default method of securing requests
        $token   = rcube_utils::get_input_value('_token', $mode);
        $sess_id = $_COOKIE[ini_get('session.name')];

        if (empty($sess_id) || $token !== $sess_tok) {
            $this->request_status = self::REQUEST_ERROR_TOKEN;
            return false;
        }

        return true;
    }
public function check_request($mode = rcube_utils::INPUT_POST)
    {
        // check secure token in URL if enabled
        if ($token = $this->get_secure_url_token()) {
            foreach (explode('/', preg_replace('/[?#&].*$/', '', $_SERVER['REQUEST_URI'])) as $tok) {
                if ($tok == $token) {
                    return true;
                }
            }

            $this->request_status = self::REQUEST_ERROR_URL;

            return false;
        }

        $sess_tok = $this->get_request_token();

        // ajax requests
        if (rcube_utils::request_header('X-Roundcube-Request') === $sess_tok) {
            return true;
        }

        // skip empty requests
        if (($mode == rcube_utils::INPUT_POST && empty($_POST))
            || ($mode == rcube_utils::INPUT_GET && empty($_GET))
        ) {
            return true;
        }

        // default method of securing requests
        $token   = rcube_utils::get_input_value('_token', $mode);
        $sess_id = $_COOKIE[ini_get('session.name')];

        if (empty($sess_id) || $token !== $sess_tok) {
            $this->request_status = self::REQUEST_ERROR_TOKEN;
            return false;
        }

        return true;
    }
public function check_request ( $ mode = rcube_utils :: INPUT_POST ) { // check secure token in URL if enabled if ( $ token = $ this -> get_secure_url_token ( ) ) { foreach ( explode ( '/' , preg_replace ( '/[?#&].*$/' , '' , $ _SERVER [ 'REQUEST_URI' ] ) ) as $ tok ) { if ( $ tok == $ token ) { return true ; } } $ this -> request_status = self :: REQUEST_ERROR_URL ; return false ; } $ sess_tok = $ this -> get_request_token ( ) ; // ajax requests if ( rcube_utils :: request_header ( 'X-Roundcube-Request' ) === $ sess_tok ) { return true ; } // skip empty requests if ( ( $ mode == rcube_utils :: INPUT_POST && empty ( $ _POST ) ) || ( $ mode == rcube_utils :: INPUT_GET && empty ( $ _GET ) ) ) { return true ; } // default method of securing requests $ token = rcube_utils :: get_input_value ( '_token' , $ mode ) ; $ sess_id = $ _COOKIE [ ini_get ( 'session.name' ) ] ; if ( empty ( $ sess_id ) || $ token !== $ sess_tok ) { $ this -> request_status = self :: REQUEST_ERROR_TOKEN ; return false ; } return true ; }
Check if the current request contains a valid token.
Empty requests aren't checked until use_secure_urls is set.

@param int $mode Request method

@return boolean True if request token is valid false if not
Check if the current request contains a valid token . Empty requests aren t checked until use_secure_urls is set .