summaryrefslogtreecommitdiff
path: root/source3/web
diff options
context:
space:
mode:
authorKai Blin <kai@samba.org>2011-07-08 12:58:53 +0200
committerJeremy Allison <jra@samba.org>2011-07-26 22:22:25 +0200
commit15ed2a0eedb530fbfd244ed6c0121db18102860f (patch)
treed224f420ecfb85f09174284fa01898946f340a88 /source3/web
parentc379b3623a484c1522f5c16d9a32019155ad1a46 (diff)
downloadsamba-15ed2a0eedb530fbfd244ed6c0121db18102860f.tar.gz
samba-15ed2a0eedb530fbfd244ed6c0121db18102860f.tar.bz2
samba-15ed2a0eedb530fbfd244ed6c0121db18102860f.zip
s3 swat: Add XSRF protection to status page
Signed-off-by: Kai Blin <kai@samba.org>
Diffstat (limited to 'source3/web')
-rw-r--r--source3/web/statuspage.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/source3/web/statuspage.c b/source3/web/statuspage.c
index 02f5ca78e9..5314f33432 100644
--- a/source3/web/statuspage.c
+++ b/source3/web/statuspage.c
@@ -249,9 +249,14 @@ void status_page(void)
int nr_running=0;
bool waitup = False;
TALLOC_CTX *ctx = talloc_stackframe();
+ const char form_name[] = "status";
smbd_pid = pid_to_procid(pidfile_pid("smbd"));
+ if (!verify_xsrf_token(form_name)) {
+ goto output_page;
+ }
+
if (cgi_variable("smbd_restart") || cgi_variable("all_restart")) {
stop_smbd();
start_smbd();
@@ -328,9 +333,11 @@ void status_page(void)
initPid2Machine ();
+output_page:
printf("<H2>%s</H2>\n", _("Server Status"));
printf("<FORM method=post>\n");
+ print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
if (!autorefresh) {
printf("<input type=submit value=\"%s\" name=\"autorefresh\">\n", _("Auto Refresh"));