adam/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-08-07 01:03:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

bug 1328: implement check_pwg_token for emails on user comments management.

Browse Source 
The check_pwg_token and get_pwg_token functions were moved to the public side
(for use on comments.php)

The email sent to admins on new user comment does not directly includes
validate/delete actions.

git-svn-id: http://piwigo.org/svn/branches/2.0@4508 68402e56-0260-453c-a942-63ccdbb3a9ee
This commit is contained in:
plegall
2009-12-17 22:47:31 +00:00
parent 587aaa0210
commit 2119631cd7
4 changed files with 115 additions and 76 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/include/functions.php
-33
View File
@@ -23,39 +23,6 @@
include(PHPWG_ROOT_PATH.'admin/include/functions_metadata.php');
/**
* check token comming from form posted or get params to prevent csrf attacks
* if pwg_token is empty action doesn't require token
* else pwg_token is compare to server token
*
* @return void access denied if token given is not equal to server token
*/
function check_pwg_token()
{
$valid_token = get_pwg_token();
$given_token = null;
if (!empty($_POST['pwg_token']))
{
$given_token = $_POST['pwg_token'];
}
elseif (!empty($_GET['pwg_token']))
{
$given_token = $_GET['pwg_token'];
}
if ($given_token != $valid_token)
{
access_denied();
}
}
function get_pwg_token()
{
global $conf;
return hash_hmac('md5', session_id(), $conf['secret_key']);
}
// The function delete_site deletes a site and call the function
// delete_categories for each primary category of the site
function delete_site( $id )