Changeset 1614

Show
Ignore:
Timestamp:
08/06/08 07:51:33 (4 months ago)
Author:
misja
Message:

Applied attachment:ticket:385:weblog_csrf_actions.diff, attachment:ticket:385:weblog_csrf_add.diff and attachment:ticket:385:weblog_csrf_edit.diff, fixes #385

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • devel/mod/blog/lib/weblogs_actions.php

    r1540 r1614  
    1010    // Create a new weblog post 
    1111    case "weblogs:post:add": 
     12        // Check form_key 
     13        if (!elggform_key_check(optional_param('form_key'), "blog_add_{$page_owner}")) break; 
    1214        $post = new StdClass; 
    1315        $post->title = trim(optional_param('new_weblog_title')); 
    …… 
    6769        $post->icon = optional_param('edit_weblog_icon',user_info("icon",$_SESSION['userid']),PARAM_INT); 
    6870        $post->ident = optional_param('edit_weblog_post_id',0,PARAM_INT); 
     71 
    6972        if (logged_on && !empty($post->body) && !empty($post->access) && !empty($post->ident)) { 
    7073            $exists = false; 
    7174            if ($oldpost = get_record('weblog_posts','ident',$post->ident)) { 
    72               if (run("permissions:check", array("weblog:edit", $oldpost->owner,$oldpost->weblog))) { 
     75        // Check form key here 
     76              if (run("permissions:check", array("weblog:edit", $oldpost->owner,$oldpost->weblog)) && elggform_key_check(optional_param('form_key'), "blog_edit_{$oldpost->weblog}_{$post->ident}")) { 
    7377                    $exists = true; 
    7478                } 

  • devel/mod/blog/lib/weblogs_posts_add.php

    r1540 r1614  
    4444    $postButton = __gettext("Publish"); // gettext variable 
    4545 
     46    // form key 
     47    $form_key = elggform_key_get("blog_add_{$page_owner}"); 
    4648 
    4749 
    …… 
    110112        <input type="hidden" name="action" value="weblogs:post:add" /> 
    111113        <input type="hidden" name="extension" value="{$extensionContext}" /> 
     114        <input type="hidden" name="form_key" value="{$form_key}" /> 
    112115        <input type="submit" value="$postButton" /> 
    113116    </p> 

  • devel/mod/blog/lib/weblogs_posts_edit.php

    r1540 r1614  
    5656$postButton = __gettext("Publish"); 
    5757 
     58// Form key against CSRF 
     59$form_key = elggform_key_get("blog_edit_{$page_owner}_{$post->ident}"); 
    5860 
    5961$body = <<< END 
    …… 
    127129        <input type="hidden" name="edit_weblog_post_id" value="{$post->ident}" /> 
    128130        <input type="hidden" name="extension" value="{$extensionContext}" /> 
     131        <input type="hidden" name="form_key" value="{$form_key}" /> 
    129132        <input type="submit" value="$postButton" /> 
    130133    </p>