summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKai Blin <kai@samba.org>2011-07-08 15:03:44 +0200
committerJeremy Allison <jra@samba.org>2011-07-26 22:22:25 +0200
commit99fa6b386aad3a78ea54f1f083d40754c9ef6703 (patch)
tree42ca3452aab8cb2f0df05bd007a057557efd1d98
parentab98edd79dd98c989812ea9eab0418cfcb6bfc86 (diff)
downloadsamba-99fa6b386aad3a78ea54f1f083d40754c9ef6703.tar.gz
samba-99fa6b386aad3a78ea54f1f083d40754c9ef6703.tar.bz2
samba-99fa6b386aad3a78ea54f1f083d40754c9ef6703.zip
s3 swat: Add XSRF protection to wizard page
Signed-off-by: Kai Blin <kai@samba.org>
-rw-r--r--source3/web/swat.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/source3/web/swat.c b/source3/web/swat.c
index cdbbcb479b..ac182dd707 100644
--- a/source3/web/swat.c
+++ b/source3/web/swat.c
@@ -765,6 +765,11 @@ static void wizard_page(void)
int have_home = -1;
int HomeExpo = 0;
int SerType = 0;
+ const char form_name[] = "wizard";
+
+ if (!verify_xsrf_token(form_name)) {
+ goto output_page;
+ }
if (cgi_variable("Rewrite")) {
(void) rewritecfg_file();
@@ -856,9 +861,11 @@ static void wizard_page(void)
role = lp_server_role();
+output_page:
/* Here we go ... */
printf("<H2>%s</H2>\n", _("Samba Configuration Wizard"));
printf("<form method=post action=wizard>\n");
+ print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
if (have_write_access) {
printf("%s\n", _("The \"Rewrite smb.conf file\" button will clear the smb.conf file of all default values and of comments."));