diff options
| author | Angie Byron <webchick@24967.no-reply.drupal.org> | 2010-03-28 07:00:30 +0000 |
|---|---|---|
| committer | Angie Byron <webchick@24967.no-reply.drupal.org> | 2010-03-28 07:00:30 +0000 |
| commit | 3359fb5c1cd034aedc05fb961a3360f04a379c49 (patch) | |
| tree | efcf93ada9c929ad7c7502d8d5c88cccad7411e2 /modules/comment | |
| parent | 3520ea515364a528d06fc8ad477a103ff168a1f7 (diff) | |
| download | brdo-3359fb5c1cd034aedc05fb961a3360f04a379c49.tar.gz brdo-3359fb5c1cd034aedc05fb961a3360f04a379c49.tar.bz2 | |
#66264 by boombatower, grendzy, et al: Remove CSRF vulnerability from comment module.
Diffstat (limited to 'modules/comment')
| -rw-r--r-- | modules/comment/comment.module | 1 | ||||
| -rw-r--r-- | modules/comment/comment.pages.inc | 3 | ||||
| -rw-r--r-- | modules/comment/comment.test | 4 |
3 files changed, 8 insertions, 0 deletions
diff --git a/modules/comment/comment.module b/modules/comment/comment.module index ab71b724b..aa66c9f87 100644 --- a/modules/comment/comment.module +++ b/modules/comment/comment.module @@ -991,6 +991,7 @@ function comment_links($comment, $node) { 'title' => t('approve'), 'href' => "comment/$comment->cid/approve", 'html' => TRUE, + 'query' => array('token' => drupal_get_token("comment/$comment->cid/approve")), ); } } diff --git a/modules/comment/comment.pages.inc b/modules/comment/comment.pages.inc index 4156beb18..948fcad11 100644 --- a/modules/comment/comment.pages.inc +++ b/modules/comment/comment.pages.inc @@ -107,6 +107,9 @@ function comment_reply($node, $pid = NULL) { * A comment identifier. */ function comment_approve($cid) { + if (!isset($_GET['token']) || !drupal_valid_token($_GET['token'], "comment/$cid/approve")) { + return MENU_ACCESS_DENIED; + } if ($comment = comment_load($cid)) { $comment->status = COMMENT_PUBLISHED; comment_save($comment); diff --git a/modules/comment/comment.test b/modules/comment/comment.test index ec355a13c..f9d151ea7 100644 --- a/modules/comment/comment.test +++ b/modules/comment/comment.test @@ -954,6 +954,10 @@ class CommentApprovalTest extends CommentHelperCase { // Approve comment. $this->drupalLogin($this->admin_user); + $this->drupalGet('comment/1/approve'); + $this->assertResponse(403, t('Forged comment approval was denied.')); + $this->drupalGet('comment/1/approve', array('query' => array('token' => 'forged'))); + $this->assertResponse(403, t('Forged comment approval was denied.')); $this->drupalGet('node/' . $this->node->nid); $this->clickLink(t('approve')); $this->drupalLogout(); |