mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-08-02 23:07:39 +02:00
Code Issues Releases Wiki Activity

[ticket/security-253] Check form key when exporting PM data

Browse Source 
SECURITY-253
This commit is contained in:
Marc Alexander
2019-12-26 14:59:14 +01:00
parent 7d90f84306
commit c44c398626
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
phpBB/includes/ucp/ucp_pm_viewfolder.php
View File

@@ -32,6 +32,8 @@ function view_folder($id, $mode, $folder_id, $folder)
$folder_info = get_pm_from($folder_id, $folder, $user->data['user_id']); $folder_info = get_pm_from($folder_id, $folder, $user->data['user_id']);
add_form_key('ucp_pm_view_folder');
if (!$submit_export) if (!$submit_export)
{ {
$user->add_lang('viewforum'); $user->add_lang('viewforum');
@@ -197,6 +199,11 @@ function view_folder($id, $mode, $folder_id, $folder)
$enclosure = $request->variable('enclosure', ''); $enclosure = $request->variable('enclosure', '');
$delimiter = $request->variable('delimiter', ''); $delimiter = $request->variable('delimiter', '');
if (!check_form_key('ucp_pm_view_folder'))
{
trigger_error('FORM_INVALID');
}
if ($export_type == 'CSV' && ($delimiter === '' || $enclosure === '')) if ($export_type == 'CSV' && ($delimiter === '' || $enclosure === ''))
{ {
$template->assign_var('PROMPT', true); $template->assign_var('PROMPT', true);