Part 2 of the SecurityToken patch to avaoid CSRF attacks

This patch adds a security token to all forms generated through the new
form class. However it is only checked for possible dangerous actions like
editing or profile changes.

darcs-hash:20070830191429-7ad00-445efea47a09a4823dfe9e3434ba5b355a80daf6.gz

1 files changed, 14 insertions, 4 deletions

diff --git a/inc/actions.php b/inc/actions.php
index d7c51282f..7330c8d95 100644
--- a/inc/actions.php
+++ b/inc/actions.php
@@ -39,8 +39,13 @@ function act_dispatch(){
     }
 
     //login stuff
-    if(in_array($ACT,array('login','logout')))
-      $ACT = act_auth($ACT);
+    if(in_array($ACT,array('login','logout'))){
+      if(checkSecurityToken()){
+        $ACT = act_auth($ACT);
+      }else{
+        $ACT = 'show';
+      }
+    }
 
     //check if user is asking to (un)subscribe a page
     if($ACT == 'subscribe' || $ACT == 'unsubscribe')
@@ -66,8 +71,13 @@ function act_dispatch(){
     }
 
     //save
-    if($ACT == 'save')
-      $ACT = act_save($ACT);
+    if($ACT == 'save'){
+      if(checkSecurityToken()){
+        $ACT = act_save($ACT);
+      }else{
+        $ACT = 'show';
+      }
+    }
 
     //cancel conflicting edit
     if($ACT == 'cancel')