diff options
| author | Andreas Gohr <andi@splitbrain.org> | 2007-08-30 21:14:29 +0200 |
|---|---|---|
| committer | Andreas Gohr <andi@splitbrain.org> | 2007-08-30 21:14:29 +0200 |
| commit | 1b2a85e896db1404d2d5fa709f4c86d6c58fc3f4 (patch) | |
| tree | 43dcbe7e9413748e6ca47e510666b3c76dc40992 /inc/auth.php | |
| parent | 634d7150e59d03e4a4987164bfe9948fb8828c70 (diff) | |
| download | rpg-1b2a85e896db1404d2d5fa709f4c86d6c58fc3f4.tar.gz rpg-1b2a85e896db1404d2d5fa709f4c86d6c58fc3f4.tar.bz2 | |
Part 2 of the SecurityToken patch to avaoid CSRF attacks
This patch adds a security token to all forms generated through the new
form class. However it is only checked for possible dangerous actions like
editing or profile changes.
darcs-hash:20070830191429-7ad00-445efea47a09a4823dfe9e3434ba5b355a80daf6.gz
Diffstat (limited to 'inc/auth.php')
| -rw-r--r-- | inc/auth.php | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/inc/auth.php b/inc/auth.php index 045ced066..3e5362a41 100644 --- a/inc/auth.php +++ b/inc/auth.php @@ -613,6 +613,7 @@ function updateprofile() { global $auth; if(empty($_POST['save'])) return false; + if(!checkSecurityToken()) return false; // should not be able to get here without Profile being possible... if(!$auth->canDo('Profile')) { |