summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKai Blin <kai@samba.org>2011-07-08 15:04:12 +0200
committerJeremy Allison <jra@samba.org>2011-07-26 22:22:25 +0200
commit68f8924c7c9157e4a324c77695fbf0e07635fb32 (patch)
treea3444f5e37043c1634ab3724647cbf9972f09f62
parent99fa6b386aad3a78ea54f1f083d40754c9ef6703 (diff)
downloadsamba-68f8924c7c9157e4a324c77695fbf0e07635fb32.tar.gz
samba-68f8924c7c9157e4a324c77695fbf0e07635fb32.tar.bz2
samba-68f8924c7c9157e4a324c77695fbf0e07635fb32.zip
s3 swat: Add XSRF protection to globals page
Signed-off-by: Kai Blin <kai@samba.org>
-rw-r--r--source3/web/swat.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/source3/web/swat.c b/source3/web/swat.c
index ac182dd707..7ce6893af1 100644
--- a/source3/web/swat.c
+++ b/source3/web/swat.c
@@ -934,9 +934,14 @@ static void globals_page(void)
{
unsigned int parm_filter = FLAG_BASIC;
int mode = 0;
+ const char form_name[] = "globals";
printf("<H2>%s</H2>\n", _("Global Parameters"));
+ if (!verify_xsrf_token(form_name)) {
+ goto output_page;
+ }
+
if (cgi_variable("Commit")) {
commit_parameters(GLOBAL_SECTION_SNUM);
save_reload(-1);
@@ -949,7 +954,9 @@ static void globals_page(void)
if ( cgi_variable("AdvMode"))
mode = 1;
+output_page:
printf("<form name=\"swatform\" method=post action=globals>\n");
+ print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
ViewModeBoxes( mode );
switch ( mode ) {