mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-07-30 21:40:43 +02:00
Code Issues Releases Wiki Activity

Merge pull request #58 from phpbb/ticket/security-253

Browse Source 
[ticket/security-253] Check form key when exporting PM data
This commit is contained in:
Marc Alexander
2020-01-03 17:19:06 +01:00
parent 03757a0663 c44c398626
commit 502407a1dd
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
phpBB/includes/ucp/ucp_pm_viewfolder.php
View File

@@ -32,6 +32,8 @@ function view_folder($id, $mode, $folder_id, $folder)
$folder_info = get_pm_from($folder_id, $folder, $user->data['user_id']);
add_form_key('ucp_pm_view_folder');
if (!$submit_export)
{
$user->add_lang('viewforum');
@@ -197,6 +199,11 @@ function view_folder($id, $mode, $folder_id, $folder)
$enclosure = $request->variable('enclosure', '');
$delimiter = $request->variable('delimiter', '');
if (!check_form_key('ucp_pm_view_folder'))
{
trigger_error('FORM_INVALID');
}
if ($export_type == 'CSV' && ($delimiter === '' || $enclosure === ''))
{
$template->assign_var('PROMPT', true);