Version 4.5.0

applications/core/modules/front/system/unsubscribe.php

@@ -11,7 +11,7 @@
 namespace IPS\core\modules\front\system;
 
 /* To prevent PHP errors (extending class does not exist) revealing path */
-if ( !defined( '\IPS\SUITE_UNIQUE_KEY' ) )
+if ( !\defined( '\IPS\SUITE_UNIQUE_KEY' ) )
 {
 	header( ( isset( $_SERVER['SERVER_PROTOCOL'] ) ? $_SERVER['SERVER_PROTOCOL'] : 'HTTP/1.0' ) . ' 403 Forbidden' );
 	exit;
@@ -29,6 +29,9 @@ class _unsubscribe extends \IPS\Dispatcher\Controller
 	 */
 	protected function manage()
 	{
+		/* Prevent the email and secure key from being exposed in referrers */
+		\IPS\Output::i()->sendHeader( "Referrer-Policy: origin" );
+
 		/* Get the member being requested */
 		if( empty( \IPS\Request::i()->email ) )
 		{