From: Evan Prodromou <evan@prodromou.name>
Date: Fri, 29 Aug 2008 05:27:32 +0000 (-0400)
Subject: csrf protection in userauthorization
X-Git-Url: https://git.mxchange.org/?a=commitdiff_plain;h=63438008e021638004a61e76a7d6627fc2f49199;p=quix0rs-gnu-social.git

csrf protection in userauthorization

darcs-hash:20080829052732-84dde-0ebb7e32236b480cc3aa2eb7a4bb2b41ff6177d6.gz
---

diff --git a/actions/userauthorization.php b/actions/userauthorization.php
index 8059c3106b..3d4661b25d 100644
--- a/actions/userauthorization.php
+++ b/actions/userauthorization.php
@@ -23,11 +23,18 @@ require_once(INSTALLDIR.'/lib/omb.php');
 define('TIMESTAMP_THRESHOLD', 300);
 
 class UserauthorizationAction extends Action {
-	
+
 	function handle($args) {
 		parent::handle($args);
 
 		if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+			# CSRF protection
+			$token = $this->trimmed('token');
+			if (!$token || $token != common_session_token()) {
+				$req = $this->get_stored_request();
+				$this->show_form(_('There was a problem with your session token. Try again, please.'), $req);
+				return;
+			}
 			# We've shown the form, now post user's choice
 			$this->send_authorization();
 		} else {