diff options
| author | Kai Blin <kai@samba.org> | 2011-07-08 15:04:48 +0200 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2011-07-26 22:22:25 +0200 |
| commit | c02df79f610d69d5311b7659f94d9161e88836ee (patch) | |
| tree | 8eb94943fcb349f3ca63ad783d3f285100f0a0f8 | |
| parent | 68f8924c7c9157e4a324c77695fbf0e07635fb32 (diff) | |
| download | samba-c02df79f610d69d5311b7659f94d9161e88836ee.tar.gz samba-c02df79f610d69d5311b7659f94d9161e88836ee.tar.bz2 samba-c02df79f610d69d5311b7659f94d9161e88836ee.zip | |
s3 swat: Add XSRF protection to shares page
Signed-off-by: Kai Blin <kai@samba.org>
| -rw-r--r-- | source3/web/swat.c | 18 |
1 files changed, 13 insertions, 5 deletions
diff --git a/source3/web/swat.c b/source3/web/swat.c index 7ce6893af1..2ad2870adc 100644 --- a/source3/web/swat.c +++ b/source3/web/swat.c @@ -996,11 +996,17 @@ static void shares_page(void) int mode = 0; unsigned int parm_filter = FLAG_BASIC; size_t converted_size; + const char form_name[] = "shares"; + + printf("<H2>%s</H2>\n", _("Share Parameters")); + + if (!verify_xsrf_token(form_name)) { + goto output_page; + } if (share) snum = lp_servicenumber(share); - printf("<H2>%s</H2>\n", _("Share Parameters")); if (cgi_variable("Commit") && snum >= 0) { commit_parameters(snum); @@ -1026,10 +1032,6 @@ static void shares_page(void) } } - printf("<FORM name=\"swatform\" method=post>\n"); - - printf("<table>\n"); - if ( cgi_variable("ViewMode") ) mode = atoi(cgi_variable_nonull("ViewMode")); if ( cgi_variable("BasicMode")) @@ -1037,6 +1039,12 @@ static void shares_page(void) if ( cgi_variable("AdvMode")) mode = 1; +output_page: + printf("<FORM name=\"swatform\" method=post>\n"); + print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name); + + printf("<table>\n"); + ViewModeBoxes( mode ); switch ( mode ) { case 0: |