GNUsocial/gnu-social
4
0
Fork 1
Code Issues Releases Wiki Activity

CSRF protection in smssettings.php

Browse Source 
darcs-hash:20080829035118-7b5ce-57613e88b29617ea422c7f7003e81ef885e3debb.gz
This commit is contained in:
Zach Copley 2008-08-28 23:51:18 -04:00
parent 6afb7f576e
commit 6be7cbc5cd
1 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
actions/smssettings.php
View File

@ -35,7 +35,7 @@ class SmssettingsAction extends EmailsettingsAction {
'id' => 'smssettings', 'id' => 'smssettings',
'action' => 'action' =>
common_local_url('smssettings'))); common_local_url('smssettings')));
common_hidden('token', common_session_token());
common_element('h2', NULL, _('Address')); common_element('h2', NULL, _('Address'));
if ($user->sms) { if ($user->sms) {
@ -117,6 +117,14 @@ class SmssettingsAction extends EmailsettingsAction {
function handle_post() { function handle_post() {
# CSRF protection
$token = $this->trimmed('token');
if (!$token || $token != common_session_token()) {
$this->show_form(_('There was a problem with your session token. Try again, please.'));
return;
}
if ($this->arg('save')) { if ($this->arg('save')) {
$this->save_preferences(); $this->save_preferences();
} else if ($this->arg('add')) { } else if ($this->arg('add')) {