diff options
| author | Tom N Harris <tnharris@whoopdedo.org> | 2012-06-27 02:48:49 -0400 |
|---|---|---|
| committer | Tom N Harris <tnharris@whoopdedo.org> | 2012-06-27 02:48:49 -0400 |
| commit | 7d01a0eac854c623a74ff7936d5eba9413aefe79 (patch) | |
| tree | dc4484d0c4ad67e81f3321c3cd30b773d726cd0a /inc/common.php | |
| parent | 90f1b7bd60332450b32e4ec0b189ddb0ab11fdf8 (diff) | |
| download | rpg-7d01a0eac854c623a74ff7936d5eba9413aefe79.tar.gz rpg-7d01a0eac854c623a74ff7936d5eba9413aefe79.tar.bz2 | |
more INPUT wrapper uses: cache purge, sectok, getID
Diffstat (limited to 'inc/common.php')
| -rw-r--r-- | inc/common.php | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/inc/common.php b/inc/common.php index 768260bbf..02ed2432b 100644 --- a/inc/common.php +++ b/inc/common.php @@ -63,9 +63,10 @@ function getSecurityToken() { * Check the secret CSRF token */ function checkSecurityToken($token = null) { + global $INPUT; if(!$_SERVER['REMOTE_USER']) return true; // no logged in user, no need for a check - if(is_null($token)) $token = $_REQUEST['sectok']; + if(is_null($token)) $token = $INPUT->str('sectok'); if(getSecurityToken() != $token) { msg('Security Token did not match. Possible CSRF attack.', -1); return false; |