diff options
| author | Kai Blin <kai@samba.org> | 2011-07-08 15:02:53 +0200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2011-07-24 20:45:39 +0200 |
| commit | ba996f0ae87f6bf4f19a4918e44dbd6d44a96561 (patch) | |
| tree | 08194eac2bcb8f227a892ee4d5603dc8a836a446 | |
| parent | 3f38cf42facc38c19e0448cbae3078b9606b08e4 (diff) | |
| download | samba-ba996f0ae87f6bf4f19a4918e44dbd6d44a96561.tar.gz samba-ba996f0ae87f6bf4f19a4918e44dbd6d44a96561.tar.xz samba-ba996f0ae87f6bf4f19a4918e44dbd6d44a96561.zip | |
s3 swat: Add XSRF protection to viewconfig page
Signed-off-by: Kai Blin <kai@samba.org>
| -rw-r--r-- | source/web/swat.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/source/web/swat.c b/source/web/swat.c index e7d84e573df..647126fc280 100644 --- a/source/web/swat.c +++ b/source/web/swat.c @@ -664,13 +664,20 @@ static void welcome_page(void) static void viewconfig_page(void) { int full_view=0; + const char form_name[] = "viewconfig"; + + if (!verify_xsrf_token(form_name)) { + goto output_page; + } if (cgi_variable("full_view")) { full_view = 1; } +output_page: printf("<H2>%s</H2>\n", _("Current Config")); printf("<form method=post>\n"); + print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name); if (full_view) { printf("<input type=submit name=\"normal_view\" value=\"%s\">\n", _("Normal View")); |