From 2dc50d7e3768548c78f095903388d53a5bee373f Mon Sep 17 00:00:00 2001 From: Evan Prodromou Date: Fri, 29 Aug 2008 01:40:17 -0400 Subject: [PATCH] CSRF protection in user registration darcs-hash:20080829054017-84dde-c9268e5c815934dcbca2451dd6c9016f2ac4a03a.gz --- actions/register.php | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/actions/register.php b/actions/register.php index e6b1931cef..aee99b6938 100644 --- a/actions/register.php +++ b/actions/register.php @@ -36,6 +36,13 @@ class RegisterAction extends Action { } function try_register() { + + $token = $this->trimmed('token'); + if (!$token || $token != common_session_token()) { + $this->show_form(_('There was a problem with your session token. Try again, please.')); + return; + } + $nickname = $this->trimmed('nickname'); $email = $this->trimmed('email'); $fullname = $this->trimmed('fullname'); @@ -139,6 +146,7 @@ class RegisterAction extends Action { common_element_start('form', array('method' => 'post', 'id' => 'login', 'action' => common_local_url('register'))); + common_hidden('token', common_session_token()); common_input('nickname', _('Nickname'), $this->trimmed('nickname'), _('1-64 lowercase letters or numbers, no punctuation or spaces. Required.')); common_password('password', _('Password'),