From 0aed09b517f394e1a2061fd85d09eb4bfa1222e6 Mon Sep 17 00:00:00 2001
From: Ludovic Marcotte <lmarcotte@inverse.ca>
Date: Mon, 16 May 2016 08:39:08 -0400
Subject: [PATCH] (doc) documented XSRF support and disabled per default for
 now

---
 Documentation/SOGoInstallationGuide.asciidoc | 4 ++++
 Scripts/sogo.conf                            | 1 +
 SoObjects/SOGo/SOGoDefaults.plist            | 1 +
 3 files changed, 6 insertions(+)

diff --git a/Documentation/SOGoInstallationGuide.asciidoc b/Documentation/SOGoInstallationGuide.asciidoc
index 5353784f7..94877303a 100644
--- a/Documentation/SOGoInstallationGuide.asciidoc
+++ b/Documentation/SOGoInstallationGuide.asciidoc
@@ -735,6 +735,10 @@ any requests being made. Default value is 0, or disabled
 |Number of seconds, defaults to 300 (or 5 minutes). Note that _SOGoCacheCleanupInterval_
 must be set to a value equal or higher than _SOGoRequestBlockInterval_.
 
+|D |SOGoXSRFValidationEnabled
+|Parameter used to enable or not XSRF (also known as CSRF) protection in SOGo.
+Default value is `NO`, or disabled.
+
 |=======================================================================
 
 Authentication using LDAP
diff --git a/Scripts/sogo.conf b/Scripts/sogo.conf
index df878f811..dd11fa398 100644
--- a/Scripts/sogo.conf
+++ b/Scripts/sogo.conf
@@ -108,6 +108,7 @@
   //SOGoSieveScriptsEnabled = YES;
   //SOGoMailAuxiliaryUserAccountsEnabled = YES;
   //SOGoTrustProxyAuthentication = NO;
+  //SOGoXSRFValidationEnabled = YES;
 
   /* General */
   //SOGoLanguage = English;
diff --git a/SoObjects/SOGo/SOGoDefaults.plist b/SoObjects/SOGo/SOGoDefaults.plist
index f68ae9a40..2b7a3a365 100644
--- a/SoObjects/SOGo/SOGoDefaults.plist
+++ b/SoObjects/SOGo/SOGoDefaults.plist
@@ -6,6 +6,7 @@
     WOPidFile = "/var/run/sogo/sogo.pid";
     WOHTTPAdaptorCapitalizeHeaders = YES;
     WOPort = "127.0.0.1:20000";
+    SOGoXSRFValidationEnabled = NO;
 
     NGImap4ConnectionStringSeparator = "/";
     NGImap4ConnectionGroupIdPrefix = "$";