summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKai Blin <kai@samba.org>2011-07-08 15:06:13 +0200
committerJeremy Allison <jra@samba.org>2011-07-26 22:22:25 +0200
commitb5d63c3c11c469e576f7e961f7d72e6d7db47ba7 (patch)
treeb448eebc48f6d1fa28931f40cf296dddfa5f45d1
parent072c199180d7d0580665f15e4182f32bf9a565c0 (diff)
downloadsamba-b5d63c3c11c469e576f7e961f7d72e6d7db47ba7.tar.gz
samba-b5d63c3c11c469e576f7e961f7d72e6d7db47ba7.tar.bz2
samba-b5d63c3c11c469e576f7e961f7d72e6d7db47ba7.zip
s3 swat: Add XSRF protection to printer page
Signed-off-by: Kai Blin <kai@samba.org>
-rw-r--r--source3/web/swat.c28
1 files changed, 18 insertions, 10 deletions
diff --git a/source3/web/swat.c b/source3/web/swat.c
index 8f64a5426f..c7bee3f70b 100644
--- a/source3/web/swat.c
+++ b/source3/web/swat.c
@@ -1345,18 +1345,15 @@ static void printers_page(void)
int i;
int mode = 0;
unsigned int parm_filter = FLAG_BASIC;
+ const char form_name[] = "printers";
+
+ if (!verify_xsrf_token(form_name)) {
+ goto output_page;
+ }
if (share)
snum = lp_servicenumber(share);
- printf("<H2>%s</H2>\n", _("Printer Parameters"));
-
- printf("<H3>%s</H3>\n", _("Important Note:"));
- printf("%s",_("Printer names marked with [*] in the Choose Printer drop-down box "));
- printf("%s",_("are autoloaded printers from "));
- printf("<A HREF=\"/swat/help/smb.conf.5.html#printcapname\" target=\"docs\">%s</A>\n", _("Printcap Name"));
- printf("%s\n", _("Attempting to delete these printers from SWAT will have no effect."));
-
if (cgi_variable("Commit") && snum >= 0) {
commit_parameters(snum);
if (snum >= iNumNonAutoPrintServices)
@@ -1385,8 +1382,6 @@ static void printers_page(void)
}
}
- printf("<FORM name=\"swatform\" method=post>\n");
-
if ( cgi_variable("ViewMode") )
mode = atoi(cgi_variable_nonull("ViewMode"));
if ( cgi_variable("BasicMode"))
@@ -1394,6 +1389,19 @@ static void printers_page(void)
if ( cgi_variable("AdvMode"))
mode = 1;
+output_page:
+ printf("<H2>%s</H2>\n", _("Printer Parameters"));
+
+ printf("<H3>%s</H3>\n", _("Important Note:"));
+ printf("%s",_("Printer names marked with [*] in the Choose Printer drop-down box "));
+ printf("%s",_("are autoloaded printers from "));
+ printf("<A HREF=\"/swat/help/smb.conf.5.html#printcapname\" target=\"docs\">%s</A>\n", _("Printcap Name"));
+ printf("%s\n", _("Attempting to delete these printers from SWAT will have no effect."));
+
+
+ printf("<FORM name=\"swatform\" method=post>\n");
+ print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
+
ViewModeBoxes( mode );
switch ( mode ) {
case 0: