GNUsocial/gnu-social
4
0
Fork 1
Code Issues Releases Wiki Activity

CSRF protection for OpenID form

Browse Source 
darcs-hash:20080829035934-84dde-cf36fd802bed76fdf15ac39b838494a414d5cc1e.gz
This commit is contained in:
Evan Prodromou 2008-08-28 23:59:34 -04:00
parent d6dd35a66a
commit 42a6492152
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
actions/openidlogin.php
View File

@ -28,6 +28,13 @@ class OpenidloginAction extends Action {
if (common_logged_in()) { if (common_logged_in()) {
common_user_error(_('Already logged in.')); common_user_error(_('Already logged in.'));
} else if ($_SERVER['REQUEST_METHOD'] == 'POST') { } else if ($_SERVER['REQUEST_METHOD'] == 'POST') {
# CSRF protection
$token = $this->trimmed('token');
if (!$token || $token != common_session_token()) {
$this->show_form(_('There was a problem with your session token. Try again, please.'));
return;
}
$openid_url = $this->trimmed('openid_url'); $openid_url = $this->trimmed('openid_url');
$result = oid_authenticate($openid_url, $result = oid_authenticate($openid_url,
'finishopenidlogin'); 'finishopenidlogin');
@ -62,6 +69,7 @@ class OpenidloginAction extends Action {
common_element_start('form', array('method' => 'post', common_element_start('form', array('method' => 'post',
'id' => 'openidlogin', 'id' => 'openidlogin',
'action' => $formaction)); 'action' => $formaction));
common_hidden('token', common_session_token());
common_input('openid_url', _('OpenID URL'), common_input('openid_url', _('OpenID URL'),
$openid_url, $openid_url,
_('Your OpenID URL')); _('Your OpenID URL'));