[Web] Important: Do not allow API actions with r/o session key, THANKS TO Samuel Oosterholt

data/web/inc/footer.inc.php

@@ -304,5 +304,12 @@ $(document).ready(function() {
 </body>
 </html>
 <?php
+if (isset($_SESSION['mailcow_cc_api'])) {
+  session_regenerate_id(true);
+  session_unset();
+  session_destroy();
+  session_write_close();
+  header("Location: /");
+}
 $stmt = null;
 $pdo = null;