aliens/SemanticScuttle
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Bug fix: prevent from CSRF vulnerabilities on profile page (thank you Etienne Z.)

Browse source 
git-svn-id: https://semanticscuttle.svn.sourceforge.net/svnroot/semanticscuttle/trunk@164 b3834d28-1941-0410-a4f8-b48e95affb8f
This commit is contained in:
mensonge 2008-11-17 14:24:44 +00:00
parent 60b9c2c903
commit 54991bce61
2 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

15
profile.php
View file

@ -73,6 +73,15 @@ if (isset($_POST['submitted']) && $currentUserID == $userid) {
$detMail = trim($_POST['pMail']);
$detPage = trim($_POST['pPage']);
$detDesc = filter($_POST['pDesc']);
// manage token preventing from CSRF vulnaribilities
if ( !isset($_SESSION['token'], $_SESSION['token_stamp'])
|| time() - $_SESSION['token_stamp'] > 600 //limit token lifetime, optionnal
|| $_SESSION['token'] != $_POST['token']) {
$error = true;
$tplVars['error'] = T_('Invalid Token');
}
if ($detPass != $detPassConf) {
$error = true;
$tplVars['error'] = T_('Password and confirmation do not match.');
@ -98,8 +107,14 @@ if (isset($_POST['submitted']) && $currentUserID == $userid) {
if ($currentUserID != $userid) {
$templatename = 'profile.tpl.php';
} else {
//Token Init
$_SESSION['token'] = md5(uniqid(rand(), true));
$_SESSION['token_stamp'] = time();
$templatename = 'editprofile.tpl.php';
$tplVars['formaction'] = createURL('profile', $user);
$tplVars['token'] = $_SESSION['token'];
}
$tplVars['row'] = $userinfo;

1
templates/editprofile.tpl.php
View file

@ -3,6 +3,7 @@ $this->includeTemplate($GLOBALS['top_include']);
?>
<form action="<?php echo $formaction; ?>" method="post">
<input type="hidden" name="token" value="<?php echo $token; ?>">
</table>