mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-08-04 15:57:45 +02:00
Code Issues Releases Wiki Activity

[ticket/security-250] Check form key when approving group membership

Browse Source 
SECURITY-250
This commit is contained in:
Marc Alexander
2019-12-24 12:44:16 +01:00
parent 3aa4b67173
commit 4f007321e1
3 changed files with 94 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
phpBB/includes/ucp/ucp_groups.php
View File

@@ -875,6 +875,11 @@ class ucp_groups
trigger_error($user->lang['NO_GROUP'] . $return_page);
}
if (!check_form_key('ucp_groups'))
{
trigger_error($user->lang('FORM_INVALID') . $return_page);
}
if (!($row = group_memberships($group_id, $user->data['user_id'])))
{
trigger_error($user->lang['NOT_MEMBER_OF_GROUP'] . $return_page);