From: Evan Prodromou <evan@prodromou.name>
Date: Fri, 29 Aug 2008 05:40:17 +0000 (-0400)
Subject: CSRF protection in user registration
X-Git-Url: https://git.mxchange.org/?a=commitdiff_plain;h=2dc50d7e3768548c78f095903388d53a5bee373f;p=quix0rs-gnu-social.git

CSRF protection in user registration

darcs-hash:20080829054017-84dde-c9268e5c815934dcbca2451dd6c9016f2ac4a03a.gz
---

diff --git a/actions/register.php b/actions/register.php
index e6b1931cef..aee99b6938 100644
--- a/actions/register.php
+++ b/actions/register.php
@@ -36,6 +36,13 @@ class RegisterAction extends Action {
 	}
 
 	function try_register() {
+		
+		$token = $this->trimmed('token');
+		if (!$token || $token != common_session_token()) {
+			$this->show_form(_('There was a problem with your session token. Try again, please.'));
+			return;
+		}
+
 		$nickname = $this->trimmed('nickname');
 		$email = $this->trimmed('email');
 		$fullname = $this->trimmed('fullname');
@@ -139,6 +146,7 @@ class RegisterAction extends Action {
 		common_element_start('form', array('method' => 'post',
 										   'id' => 'login',
 										   'action' => common_local_url('register')));
+		common_hidden('token', common_session_token());
 		common_input('nickname', _('Nickname'), $this->trimmed('nickname'),
 					 _('1-64 lowercase letters or numbers, no punctuation or spaces. Required.'));
 		common_password('password', _('Password'),