diff options
| author | Kai Blin <kai@samba.org> | 2011-07-08 15:06:13 +0200 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2011-07-26 22:22:25 +0200 |
| commit | b5d63c3c11c469e576f7e961f7d72e6d7db47ba7 (patch) | |
| tree | b448eebc48f6d1fa28931f40cf296dddfa5f45d1 | |
| parent | 072c199180d7d0580665f15e4182f32bf9a565c0 (diff) | |
| download | samba-b5d63c3c11c469e576f7e961f7d72e6d7db47ba7.tar.gz samba-b5d63c3c11c469e576f7e961f7d72e6d7db47ba7.tar.bz2 samba-b5d63c3c11c469e576f7e961f7d72e6d7db47ba7.zip | |
s3 swat: Add XSRF protection to printer page
Signed-off-by: Kai Blin <kai@samba.org>
| -rw-r--r-- | source3/web/swat.c | 28 |
1 files changed, 18 insertions, 10 deletions
diff --git a/source3/web/swat.c b/source3/web/swat.c index 8f64a5426f..c7bee3f70b 100644 --- a/source3/web/swat.c +++ b/source3/web/swat.c @@ -1345,18 +1345,15 @@ static void printers_page(void) int i; int mode = 0; unsigned int parm_filter = FLAG_BASIC; + const char form_name[] = "printers"; + + if (!verify_xsrf_token(form_name)) { + goto output_page; + } if (share) snum = lp_servicenumber(share); - printf("<H2>%s</H2>\n", _("Printer Parameters")); - - printf("<H3>%s</H3>\n", _("Important Note:")); - printf("%s",_("Printer names marked with [*] in the Choose Printer drop-down box ")); - printf("%s",_("are autoloaded printers from ")); - printf("<A HREF=\"/swat/help/smb.conf.5.html#printcapname\" target=\"docs\">%s</A>\n", _("Printcap Name")); - printf("%s\n", _("Attempting to delete these printers from SWAT will have no effect.")); - if (cgi_variable("Commit") && snum >= 0) { commit_parameters(snum); if (snum >= iNumNonAutoPrintServices) @@ -1385,8 +1382,6 @@ static void printers_page(void) } } - printf("<FORM name=\"swatform\" method=post>\n"); - if ( cgi_variable("ViewMode") ) mode = atoi(cgi_variable_nonull("ViewMode")); if ( cgi_variable("BasicMode")) @@ -1394,6 +1389,19 @@ static void printers_page(void) if ( cgi_variable("AdvMode")) mode = 1; +output_page: + printf("<H2>%s</H2>\n", _("Printer Parameters")); + + printf("<H3>%s</H3>\n", _("Important Note:")); + printf("%s",_("Printer names marked with [*] in the Choose Printer drop-down box ")); + printf("%s",_("are autoloaded printers from ")); + printf("<A HREF=\"/swat/help/smb.conf.5.html#printcapname\" target=\"docs\">%s</A>\n", _("Printcap Name")); + printf("%s\n", _("Attempting to delete these printers from SWAT will have no effect.")); + + + printf("<FORM name=\"swatform\" method=post>\n"); + print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name); + ViewModeBoxes( mode ); switch ( mode ) { case 0: |