CSRF protection in user registration

darcs-hash:20080829054017-84dde-c9268e5c815934dcbca2451dd6c9016f2ac4a03a.gz

diff --git a/actions/register.php b/actions/register.php
index e6b1931cef6de26752c7d9bbd1ed7abfaba02146..aee99b69384f2ecbdf5462a81a09d256b26384b7 100644 (file)
--- a/actions/register.php
+++ b/actions/register.php
@@ -36,6 +36,13 @@ class RegisterAction extends Action {
        }
 
        function try_register() {
+               
+               $token = $this->trimmed('token');
+               if (!$token || $token != common_session_token()) {
+                       $this->show_form(_('There was a problem with your session token. Try again, please.'));
+                       return;
+               }
+
                $nickname = $this->trimmed('nickname');
                $email = $this->trimmed('email');
                $fullname = $this->trimmed('fullname');
@@ -139,6 +146,7 @@ class RegisterAction extends Action {
                common_element_start('form', array('method' => 'post',
                                                                                   'id' => 'login',
                                                                                   'action' => common_local_url('register')));
+               common_hidden('token', common_session_token());
                common_input('nickname', _('Nickname'), $this->trimmed('nickname'),
                                         _('1-64 lowercase letters or numbers, no punctuation or spaces. Required.'));
                common_password('password', _('Password'),