diff options
| author | Kai Blin <kai@samba.org> | 2011-07-08 12:58:53 +0200 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2011-07-27 19:39:54 +0200 |
| commit | ad92cdeaea5e47852554567c4587bbe55df88507 (patch) | |
| tree | 79ee8e0d6bd68d21f216c3e9e7d4bfa90521b220 | |
| parent | e90a2cc9ea8d040b10316c6ba90fe511a6c8a898 (diff) | |
| download | samba-ad92cdeaea5e47852554567c4587bbe55df88507.tar.gz samba-ad92cdeaea5e47852554567c4587bbe55df88507.tar.xz samba-ad92cdeaea5e47852554567c4587bbe55df88507.zip | |
s3 swat: Add XSRF protection to status page
Signed-off-by: Kai Blin <kai@samba.org>
(cherry picked from commit 3f38cf42facc38c19e0448cbae3078b9606b08e4)
| -rw-r--r-- | source/web/statuspage.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/source/web/statuspage.c b/source/web/statuspage.c index 8070ae7e79d..fe545e4a281 100644 --- a/source/web/statuspage.c +++ b/source/web/statuspage.c @@ -247,9 +247,14 @@ void status_page(void) int nr_running=0; bool waitup = False; TALLOC_CTX *ctx = talloc_stackframe(); + const char form_name[] = "status"; smbd_pid = pid_to_procid(pidfile_pid("smbd")); + if (!verify_xsrf_token(form_name)) { + goto output_page; + } + if (cgi_variable("smbd_restart") || cgi_variable("all_restart")) { stop_smbd(); start_smbd(); @@ -326,9 +331,11 @@ void status_page(void) initPid2Machine (); +output_page: printf("<H2>%s</H2>\n", _("Server Status")); printf("<FORM method=post>\n"); + print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name); if (!autorefresh) { printf("<input type=submit value=\"%s\" name=\"autorefresh\">\n", _("Auto Refresh")); |