mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-08-06 08:47:45 +02:00
Code Issues Releases Wiki Activity

[ticket/security/244] Add form token check to plupload

Browse Source 
SECURTIY-244
This commit is contained in:
Marc Alexander
2019-06-30 22:40:34 +02:00
parent 525c940385
commit 56477a8f7c
4 changed files with 52 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

29
phpBB/includes/message_parser.php
View File

@@ -1524,6 +1524,35 @@ class parse_message extends bbcode_firstpass
}
}
/**
* Check attachment form token depending on submit type
*
* @param \phpbb\language\language $language Language
* @param \phpbb\request\request_interface $request Request
* @param string $form_name Form name for checking form key
*
* @return bool True if form token is not needed or valid, false if needed and invalid
*/
function check_attachment_form_token(\phpbb\language\language $language, \phpbb\request\request_interface $request, $form_name)
{
$add_file = $request->is_set_post('add_file');
$delete_file = $request->is_set_post('delete_file');
if (($add_file || $delete_file) && !check_form_key($form_name))
{
$this->warn_msg[] = $language->lang('FORM_INVALID');
if ($request->is_ajax() && $this->plupload)
{
$this->plupload->emit_error(-400, 'FORM_INVALID');
}
return false;
}
return true;
}
/**
* Parse Attachments
*/