From d2fb829296f61bdd4bef281db440bdba67840554 Mon Sep 17 00:00:00 2001 From: Evan Prodromou Date: Mon, 22 Sep 2008 23:14:19 -0400 Subject: [PATCH] CSRF protection in newmessage.php darcs-hash:20080923031419-5ed1f-5435509496b882de27d4c3acca4697cc410ee7be.gz --- actions/newmessage.php | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/actions/newmessage.php b/actions/newmessage.php index 5aa3633234..e223ed8ff7 100644 --- a/actions/newmessage.php +++ b/actions/newmessage.php @@ -37,6 +37,14 @@ class NewmessageAction extends Action { $user = common_current_user(); assert($user); # XXX: maybe an error instead... + + # CSRF protection + + $token = $this->trimmed('token'); + if (!$token || $token != common_session_token()) { + $this->show_form(_('There was a problem with your session token. Try again, please.')); + return; + } $content = $this->trimmed('content'); $to = $this->trimmed('to'); @@ -117,6 +125,8 @@ class NewmessageAction extends Action { 'type' => 'submit', 'value' => _('Send'))); + common_hidden('token', common_session_token()); + common_element_end('p'); common_element_end('form'); } -- 2.39.5