diff options
author | Kai Blin <kai@samba.org> | 2011-07-08 15:04:12 +0200 |
---|---|---|
committer | Karolin Seeger <kseeger@samba.org> | 2011-07-27 19:40:07 +0200 |
commit | 43bb2d4e9f162f2aaa4ae56dba27170fe1b8e9ae (patch) | |
tree | 7edc97f3f13923fb3bf1b7e2368586b3a04fb301 | |
parent | 5aae5319d34a9bf8c9f1f28883ac77a053b9a217 (diff) | |
download | samba-43bb2d4e9f162f2aaa4ae56dba27170fe1b8e9ae.tar.gz samba-43bb2d4e9f162f2aaa4ae56dba27170fe1b8e9ae.tar.xz samba-43bb2d4e9f162f2aaa4ae56dba27170fe1b8e9ae.zip |
s3 swat: Add XSRF protection to globals page
Signed-off-by: Kai Blin <kai@samba.org>
(cherry picked from commit 8fb3064eeaa3640af6c8b91aa5859d8bfb6d0888)
-rw-r--r-- | source/web/swat.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/source/web/swat.c b/source/web/swat.c index b6e0c0f9d8a..5d11685db18 100644 --- a/source/web/swat.c +++ b/source/web/swat.c @@ -920,9 +920,14 @@ static void globals_page(void) { unsigned int parm_filter = FLAG_BASIC; int mode = 0; + const char form_name[] = "globals"; printf("<H2>%s</H2>\n", _("Global Parameters")); + if (!verify_xsrf_token(form_name)) { + goto output_page; + } + if (cgi_variable("Commit")) { commit_parameters(GLOBAL_SECTION_SNUM); save_reload(0); @@ -935,7 +940,9 @@ static void globals_page(void) if ( cgi_variable("AdvMode")) mode = 1; +output_page: printf("<form name=\"swatform\" method=post action=globals>\n"); + print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name); ViewModeBoxes( mode ); switch ( mode ) { |