nik/davical
1
0
Fork 0
mirror of https://gitlab.com/davical-project/davical.git synced 2026-06-17 06:20:45 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Fix CSRF not being checked in collection-edit.php

Browse Source
This commit is contained in:
nielsvangijzen 2019-12-06 09:30:16 +01:00
parent a3acb770ac
commit c8a0ca4531
1 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
inc/ui/collection-edit.php
View File

@ -66,6 +66,12 @@ if ( isset($privsql) ) {
$can_write_collection = ($session->AllowedTo('Admin') || (bindec($permissions->priv) & privilege_to_bits('DAV::bind')) );
}
// Verify CSRF token
if($_SERVER['REQUEST_METHOD'] === "POST" && !verifyCsrfPost()) {
$c->messages[] = i18n("A valid CSRF token must be provided");
$can_write_collection = false;
}
dbg_error_log('collection-edit', "Can write collection: %s", ($can_write_collection? 'yes' : 'no') );
$pwstars = '@@@@@@@@@@';