Mibew/i18n
1
0
Fork 0
mirror of https://github.com/Mibew/i18n.git synced 2025-01-23 05:40:30 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

add csrf token check to avatar upload

Browse Source
This commit is contained in:
YuFei Zhu 2012-05-01 12:58:05 +01:00 committed by Dmitriy Simushev
parent cb77595747
commit 7035c3feba
3 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/messenger/webim/libs/common.php
View File

@ -779,11 +779,13 @@ function csrfchecktoken(){
die("CSRF failure"); die("CSRF failure");
} }
} else if(($_GET['act'] == 'del' || $_GET['act'] == 'delete') && $_GET['csrf_token'] != $_SESSION['csrf_token']){ } else if(isset($_GET['act'])){
if(($_GET['act'] == 'del' || $_GET['act'] == 'delete') && $_GET['csrf_token'] != $_SESSION['csrf_token']){
die("CSRF failure"); die("CSRF failure");
} }
} }
}
/* print csrf token as a hidden field*/ /* print csrf token as a hidden field*/
function print_csrf_token_input(){ function print_csrf_token_input(){

2
src/messenger/webim/operator/avatar.php
View File

@ -23,6 +23,8 @@ require_once('../libs/common.php');
require_once('../libs/operator.php'); require_once('../libs/operator.php');
require_once('../libs/operator_settings.php'); require_once('../libs/operator_settings.php');
csrfchecktoken();
$operator = check_login(); $operator = check_login();
$opId = verifyparam("op", "/^\d{1,9}$/"); $opId = verifyparam("op", "/^\d{1,9}$/");

1
src/messenger/webim/view/avatar.php
View File

@ -36,6 +36,7 @@ require_once('inc_errors.php');
?> ?>
<form name="avatarForm" method="post" action="<?php echo $webimroot ?>/operator/avatar.php" enctype="multipart/form-data"> <form name="avatarForm" method="post" action="<?php echo $webimroot ?>/operator/avatar.php" enctype="multipart/form-data">
<?php print_csrf_token_input() ?>
<input type="hidden" name="op" value="<?php echo $page['opid'] ?>"/> <input type="hidden" name="op" value="<?php echo $page['opid'] ?>"/>
<div> <div>
<?php print_tabbar(); ?> <?php print_tabbar(); ?>