From 77f02bfd76ed13dd14044d04cdd8d28213e1848d Mon Sep 17 00:00:00 2001
From: plegall <plg@piwigo.org>
Date: Mon, 18 Dec 2017 15:13:49 +0100
Subject: [PATCH] fixes #822, add token on configuration page to prevent CSRF

---
 admin/configuration.php                                   | 2 ++
 admin/themes/default/template/configuration_comments.tpl  | 1 +
 admin/themes/default/template/configuration_default.tpl   | 1 +
 admin/themes/default/template/configuration_display.tpl   | 1 +
 admin/themes/default/template/configuration_main.tpl      | 1 +
 admin/themes/default/template/configuration_sizes.tpl     | 1 +
 admin/themes/default/template/configuration_watermark.tpl | 1 +
 7 files changed, 8 insertions(+)

diff --git a/admin/configuration.php b/admin/configuration.php
index 2b76aef5d..9e8cc5268 100644
--- a/admin/configuration.php
+++ b/admin/configuration.php
@@ -150,6 +150,7 @@ $mail_themes = array(
 //------------------------------ verification and registration of modifications
 if (isset($_POST['submit']))
 {
+  check_pwg_token();
   $int_pattern = '/^\d+$/';
 
   switch ($page['section'])
@@ -320,6 +321,7 @@ $action.= '&amp;section='.$page['section'];
 $template->assign(
   array(
     'U_HELP' => get_root_url().'admin/popuphelp.php?page=configuration',
+    'PWG_TOKEN' => get_pwg_token(),
     'F_ACTION'=>$action
     ));
 
diff --git a/admin/themes/default/template/configuration_comments.tpl b/admin/themes/default/template/configuration_comments.tpl
index d8974d9c6..f77c094b2 100644
--- a/admin/themes/default/template/configuration_comments.tpl
+++ b/admin/themes/default/template/configuration_comments.tpl
@@ -158,4 +158,5 @@
   </button>
 </p>
 
+<input type="hidden" name="pwg_token" value="{$PWG_TOKEN}">
 </form>
\ No newline at end of file
diff --git a/admin/themes/default/template/configuration_default.tpl b/admin/themes/default/template/configuration_default.tpl
index 789d89734..14e112d9e 100644
--- a/admin/themes/default/template/configuration_default.tpl
+++ b/admin/themes/default/template/configuration_default.tpl
@@ -58,4 +58,5 @@
 
 </div>
 
+<input type="hidden" name="pwg_token" value="{$PWG_TOKEN}">
 </form>
\ No newline at end of file
diff --git a/admin/themes/default/template/configuration_display.tpl b/admin/themes/default/template/configuration_display.tpl
index fb47b22d9..a898f7714 100644
--- a/admin/themes/default/template/configuration_display.tpl
+++ b/admin/themes/default/template/configuration_display.tpl
@@ -309,4 +309,5 @@
   </button>
 </p>
 
+<input type="hidden" name="pwg_token" value="{$PWG_TOKEN}">
 </form>
\ No newline at end of file
diff --git a/admin/themes/default/template/configuration_main.tpl b/admin/themes/default/template/configuration_main.tpl
index 6fab36036..3a3fdf7bc 100644
--- a/admin/themes/default/template/configuration_main.tpl
+++ b/admin/themes/default/template/configuration_main.tpl
@@ -215,4 +215,5 @@ jQuery("input[name='mail_theme']").change(function() {
   </button>
 </p>
 
+<input type="hidden" name="pwg_token" value="{$PWG_TOKEN}">
 </form>
\ No newline at end of file
diff --git a/admin/themes/default/template/configuration_sizes.tpl b/admin/themes/default/template/configuration_sizes.tpl
index a9c65ba23..93ff48c17 100644
--- a/admin/themes/default/template/configuration_sizes.tpl
+++ b/admin/themes/default/template/configuration_sizes.tpl
@@ -231,4 +231,5 @@
   </button>
 </p>
 
+<input type="hidden" name="pwg_token" value="{$PWG_TOKEN}">
 </form>
\ No newline at end of file
diff --git a/admin/themes/default/template/configuration_watermark.tpl b/admin/themes/default/template/configuration_watermark.tpl
index c76efec36..39898f6cd 100644
--- a/admin/themes/default/template/configuration_watermark.tpl
+++ b/admin/themes/default/template/configuration_watermark.tpl
@@ -137,4 +137,5 @@
   </button>
 </p>
 
+<input type="hidden" name="pwg_token" value="{$PWG_TOKEN}">
 </form>
\ No newline at end of file