iarv/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-05-05 13:02:48 +02:00
Code Issues Packages Projects Releases Wiki Activity

fixes #822, add token on configuration page to prevent CSRF

Browse Source
This commit is contained in:
plegall
2017-12-18 15:13:49 +01:00
parent 9e29db0481
commit 77f02bfd76
7 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
admin/configuration.php
View File

@@ -150,6 +150,7 @@ $mail_themes = array(
//------------------------------ verification and registration of modifications //------------------------------ verification and registration of modifications
if (isset($_POST['submit'])) if (isset($_POST['submit']))
{ {
check_pwg_token();
$int_pattern = '/^\d+$/'; $int_pattern = '/^\d+$/';
switch ($page['section']) switch ($page['section'])
@@ -320,6 +321,7 @@ $action.= '&section='.$page['section'];
$template->assign( $template->assign(
array( array(
'U_HELP' => get_root_url().'admin/popuphelp.php?page=configuration', 'U_HELP' => get_root_url().'admin/popuphelp.php?page=configuration',
'PWG_TOKEN' => get_pwg_token(),
'F_ACTION'=>$action 'F_ACTION'=>$action
)); ));

1
admin/themes/default/template/configuration_comments.tpl
View File

@@ -158,4 +158,5 @@
</button> </button>
</p> </p>
<input type="hidden" name="pwg_token" value="{$PWG_TOKEN}">
</form> </form>

1
admin/themes/default/template/configuration_default.tpl
View File

@@ -58,4 +58,5 @@
</div> </div>
<input type="hidden" name="pwg_token" value="{$PWG_TOKEN}">
</form> </form>

1
admin/themes/default/template/configuration_display.tpl
View File

@@ -309,4 +309,5 @@
</button> </button>
</p> </p>
<input type="hidden" name="pwg_token" value="{$PWG_TOKEN}">
</form> </form>

1
admin/themes/default/template/configuration_main.tpl
View File

@@ -215,4 +215,5 @@ jQuery("input[name='mail_theme']").change(function() {
</button> </button>
</p> </p>
<input type="hidden" name="pwg_token" value="{$PWG_TOKEN}">
</form> </form>

1
admin/themes/default/template/configuration_sizes.tpl
View File

@@ -231,4 +231,5 @@
</button> </button>
</p> </p>
<input type="hidden" name="pwg_token" value="{$PWG_TOKEN}">
</form> </form>

1
admin/themes/default/template/configuration_watermark.tpl
View File

@@ -137,4 +137,5 @@
</button> </button>
</p> </p>
<input type="hidden" name="pwg_token" value="{$PWG_TOKEN}">
</form> </form>