From 407ae61fbfc8ee1643a4db8ea9b104f031b32e0f Mon Sep 17 00:00:00 2001 From: Kai Blin Date: Fri, 8 Jul 2011 15:06:13 +0200 Subject: s3 swat: Add XSRF protection to printer page Signed-off-by: Kai Blin --- source/web/swat.c | 28 ++++++++++++++++++---------- 1 file changed, 18 insertions(+), 10 deletions(-) diff --git a/source/web/swat.c b/source/web/swat.c index 524248481b9..4582a632edd 100644 --- a/source/web/swat.c +++ b/source/web/swat.c @@ -1332,18 +1332,15 @@ static void printers_page(void) int i; int mode = 0; unsigned int parm_filter = FLAG_BASIC; + const char form_name[] = "printers"; + + if (!verify_xsrf_token(form_name)) { + goto output_page; + } if (share) snum = lp_servicenumber(share); - printf("

%s

\n", _("Printer Parameters")); - - printf("

%s

\n", _("Important Note:")); - printf("%s",_("Printer names marked with [*] in the Choose Printer drop-down box ")); - printf("%s",_("are autoloaded printers from ")); - printf("%s\n", _("Printcap Name")); - printf("%s\n", _("Attempting to delete these printers from SWAT will have no effect.")); - if (cgi_variable("Commit") && snum >= 0) { commit_parameters(snum); if (snum >= iNumNonAutoPrintServices) @@ -1372,8 +1369,6 @@ static void printers_page(void) } } - printf("
\n"); - if ( cgi_variable("ViewMode") ) mode = atoi(cgi_variable_nonull("ViewMode")); if ( cgi_variable("BasicMode")) @@ -1381,6 +1376,19 @@ static void printers_page(void) if ( cgi_variable("AdvMode")) mode = 1; +output_page: + printf("

%s

\n", _("Printer Parameters")); + + printf("

%s

\n", _("Important Note:")); + printf("%s",_("Printer names marked with [*] in the Choose Printer drop-down box ")); + printf("%s",_("are autoloaded printers from ")); + printf("%s\n", _("Printcap Name")); + printf("%s\n", _("Attempting to delete these printers from SWAT will have no effect.")); + + + printf("\n"); + print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name); + ViewModeBoxes( mode ); switch ( mode ) { case 0: -- cgit