CSRF protection in openidsettings

darcs-hash:20080829042908-84dde-1d1a22dfd3d89c5521aeb9069dc64c5f6dad3a27.gz

diff --git a/actions/openidsettings.php b/actions/openidsettings.php
index e77de88b1ae6c5b65a6a01785768063bad24f73b..f539d111f9e302abef5daf1f98c6e5b355839879 100644 (file)
--- a/actions/openidsettings.php
+++ b/actions/openidsettings.php
@@ -40,6 +40,7 @@ class OpenidsettingsAction extends SettingsAction {
                                                                                   'id' => 'openidadd',
                                                                                   'action' =>
                                                                                   common_local_url('openidsettings')));
+               common_hidden('token', common_session_token());
                common_element('h2', NULL, _('Add OpenID'));
                common_element('p', NULL,
                                           _('If you want to add an OpenID to your account, ' .
@@ -93,6 +94,7 @@ class OpenidsettingsAction extends SettingsAction {
                                                                                                           'action' =>
                                                                                                           common_local_url('openidsettings')));
                                        common_element_start('p');
+                                       common_hidden('token', common_session_token());
                                        common_element('a', array('href' => $oid->canonical),
                                                                   $oid->display);
                                        common_element('input', array('type' => 'hidden',
@@ -115,6 +117,13 @@ class OpenidsettingsAction extends SettingsAction {
        }
 
        function handle_post() {
+               # CSRF protection
+               $token = $this->trimmed('token');
+               if (!$token || $token != common_session_token()) {
+                       $this->show_form(_('There was a problem with your session token. Try again, please.'));
+                       return;
+               }
+
                if ($this->arg('add')) {
                        $result = oid_authenticate($this->trimmed('openid_url'), 'finishaddopenid');
                        if (is_string($result)) { # error message