mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-04-13 04:13:29 +02:00
Code Issues Releases Wiki Activity

[ticket/14789] Remove obsolete check_form_key() and add missing hashes

Browse Source 
PHPBB3-14789
This commit is contained in:
Marc Alexander 2016-09-30 23:26:04 +01:00
parent 88d7c4fe57
commit 4e5f29a21b
No known key found for this signature in database
GPG Key ID: 50E0D2423696F995
2 changed files with 8 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
phpBB/includes/acp/acp_database.php
View File

@ -233,11 +233,6 @@ class acp_database
$file = request_var('file', '');
$download = request_var('download', '');
if (!check_form_key($form_key))
{
trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
}
if (!preg_match('#^backup_\d{10,}_[a-z\d]{16}\.(sql(?:\.(?:gz|bz2))?)$#', $file, $matches))
{
trigger_error($user->lang['BACKUP_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);

10
phpBB/includes/acp/acp_users.php
View File

@ -2274,6 +2274,12 @@ class acp_users
{
trigger_error($user->lang['NO_GROUP'] . adm_back_link($this->u_action . '&u=' . $user_id), E_USER_WARNING);
}
if (!check_link_hash($request->variable('hash', ''), 'acp_users'))
{
trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
}
group_user_attributes($action, $group_id, $user_id);
if ($action == 'default')
@ -2431,8 +2437,8 @@ class acp_users
{
$template->assign_block_vars('group', array(
'U_EDIT_GROUP' => append_sid("{$phpbb_admin_path}index.$phpEx", "i=groups&mode=manage&action=edit&u=$user_id&g={$data['group_id']}&back_link=acp_users_groups"),
'U_DEFAULT' => $this->u_action . "&action=default&u=$user_id&g=" . $data['group_id'],
'U_DEMOTE_PROMOTE' => $this->u_action . '&action=' . (($data['group_leader']) ? 'demote' : 'promote') . "&u=$user_id&g=" . $data['group_id'],
'U_DEFAULT' => $this->u_action . "&action=default&u=$user_id&g=" . $data['group_id'] . '&hash=' . generate_link_hash('acp_users'),
'U_DEMOTE_PROMOTE' => $this->u_action . '&action=' . (($data['group_leader']) ? 'demote' : 'promote') . "&u=$user_id&g=" . $data['group_id'] . '&hash=' . generate_link_hash('acp_users'),
'U_DELETE' => $this->u_action . "&action=delete&u=$user_id&g=" . $data['group_id'],
'U_APPROVE' => ($group_type == 'pending') ? $this->u_action . "&action=approve&u=$user_id&g=" . $data['group_id'] : '',