diff options
| author | Kai Blin <kai@samba.org> | 2011-07-08 15:04:12 +0200 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2011-07-26 22:22:25 +0200 |
| commit | 68f8924c7c9157e4a324c77695fbf0e07635fb32 (patch) | |
| tree | a3444f5e37043c1634ab3724647cbf9972f09f62 | |
| parent | 99fa6b386aad3a78ea54f1f083d40754c9ef6703 (diff) | |
| download | samba-68f8924c7c9157e4a324c77695fbf0e07635fb32.tar.gz samba-68f8924c7c9157e4a324c77695fbf0e07635fb32.tar.bz2 samba-68f8924c7c9157e4a324c77695fbf0e07635fb32.zip | |
s3 swat: Add XSRF protection to globals page
Signed-off-by: Kai Blin <kai@samba.org>
| -rw-r--r-- | source3/web/swat.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/source3/web/swat.c b/source3/web/swat.c index ac182dd707..7ce6893af1 100644 --- a/source3/web/swat.c +++ b/source3/web/swat.c @@ -934,9 +934,14 @@ static void globals_page(void) { unsigned int parm_filter = FLAG_BASIC; int mode = 0; + const char form_name[] = "globals"; printf("<H2>%s</H2>\n", _("Global Parameters")); + if (!verify_xsrf_token(form_name)) { + goto output_page; + } + if (cgi_variable("Commit")) { commit_parameters(GLOBAL_SECTION_SNUM); save_reload(-1); @@ -949,7 +954,9 @@ static void globals_page(void) if ( cgi_variable("AdvMode")) mode = 1; +output_page: printf("<form name=\"swatform\" method=post action=globals>\n"); + print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name); ViewModeBoxes( mode ); switch ( mode ) { |