mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-08-07 01:06:48 +02:00
Code Issues Releases Wiki Activity

[ticket/14789] Move form key checks to where they actually do something

Browse Source 
PHPBB3-14789
This commit is contained in:
Marc Alexander
2016-09-30 22:32:54 +01:00
parent 2fd2fb94cf
commit 88d7c4fe57
2 changed files with 26 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
phpBB/includes/acp/acp_database.php
View File

@@ -42,11 +42,6 @@ class acp_database
$form_key = 'acp_database';
add_form_key($form_key);
if ($submit && !check_form_key($form_key))
{
trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
}
$template->assign_vars(array(
'MODE' => $mode
));
@@ -70,6 +65,11 @@ class acp_database
trigger_error($user->lang['TABLE_SELECT_ERROR'] . adm_back_link($this->u_action), E_USER_WARNING);
}
if (!check_form_key($form_key))
{
trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
}
$store = $download = $structure = $schema_data = false;
if ($where == 'store_and_download' || $where == 'store')
@@ -233,6 +233,11 @@ class acp_database
$file = request_var('file', '');
$download = request_var('download', '');
if (!check_form_key($form_key))
{
trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
}
if (!preg_match('#^backup_\d{10,}_[a-z\d]{16}\.(sql(?:\.(?:gz|bz2))?)$#', $file, $matches))
{
trigger_error($user->lang['BACKUP_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);