mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-04-21 16:22:22 +02:00
Code Issues Releases Wiki Activity

Merge pull request #3 from phpbb/ticket/security-161

Browse Source 
[ticket/security-161] Add form token to styles management form.
This commit is contained in:
Joas Schilling 2014-10-23 01:38:12 +02:00
commit e4c8e4905c
1 changed files with 14 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
phpBB/includes/acp/acp_styles.php
View File

@ -70,11 +70,6 @@ class acp_styles
$action = $this->request->variable('action', '');
$post_actions = array('install', 'activate', 'deactivate', 'uninstall');
if ($action && in_array($action, $post_actions) && !check_link_hash($request->variable('hash', ''), $action))
{
trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
}
foreach ($post_actions as $key)
{
if ($this->request->is_set_post($key))
@ -83,6 +78,18 @@ class acp_styles
}
}
// The uninstall action uses confirm_box() to verify the validity of the request,
// so there is no need to check for a valid token here.
if (in_array($action, $post_actions) && $action != 'uninstall')
{
$is_valid_request = check_link_hash($request->variable('hash', ''), $action) || check_form_key('styles_management');
if (!$is_valid_request)
{
trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
}
}
if ($action != '')
{
$this->s_hidden_fields['action'] = $action;
@ -122,6 +129,8 @@ class acp_styles
*/
protected function frontend()
{
add_form_key('styles_management');
// Check mode
switch ($this->mode)
{