GNUsocial
/
gnu-social
4
0
Fork 1
Code Issues Releases Wiki Activity

CSRF protection in newmessage.php 

darcs-hash:20080923031419-5ed1f-5435509496b882de27d4c3acca4697cc410ee7be.gz
This commit is contained in:
Evan Prodromou 2008-09-22 23:14:19 -04:00
parent 6e646570de
commit d2fb829296
1 changed files with 10 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
actions/newmessage.php
View File

@ -37,6 +37,14 @@ class NewmessageAction extends Action {
$user = common_current_user();
assert($user); # XXX: maybe an error instead...
# CSRF protection
$token = $this->trimmed('token');
if (!$token || $token != common_session_token()) {
$this->show_form(_('There was a problem with your session token. Try again, please.'));
return;
}
$content = $this->trimmed('content');
$to = $this->trimmed('to');
@ -117,6 +125,8 @@ class NewmessageAction extends Action {
'type' => 'submit',
'value' => _('Send')));
common_hidden('token', common_session_token());
common_element_end('p');
common_element_end('form');
}