diff options
| author | Kai Blin <kai@samba.org> | 2011-07-08 15:03:15 +0200 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2011-07-26 22:22:25 +0200 |
| commit | ab98edd79dd98c989812ea9eab0418cfcb6bfc86 (patch) | |
| tree | c1f81d127bd5db817ad6ee1a1c4f528ead39d4e1 /source3/web | |
| parent | 00d255fc1d91f2baae9294c838012b9b2cb6dfbc (diff) | |
| download | samba-ab98edd79dd98c989812ea9eab0418cfcb6bfc86.tar.gz samba-ab98edd79dd98c989812ea9eab0418cfcb6bfc86.tar.bz2 samba-ab98edd79dd98c989812ea9eab0418cfcb6bfc86.zip | |
s3 swat: Add XSRF protection to wizard_params page
Signed-off-by: Kai Blin <kai@samba.org>
Diffstat (limited to 'source3/web')
| -rw-r--r-- | source3/web/swat.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/source3/web/swat.c b/source3/web/swat.c index 9366145700..cdbbcb479b 100644 --- a/source3/web/swat.c +++ b/source3/web/swat.c @@ -711,18 +711,25 @@ output_page: static void wizard_params_page(void) { unsigned int parm_filter = FLAG_WIZARD; + const char form_name[] = "wizard_params"; /* Here we first set and commit all the parameters that were selected in the previous screen. */ printf("<H2>%s</H2>\n", _("Wizard Parameter Edit Page")); + if (!verify_xsrf_token(form_name)) { + goto output_page; + } + if (cgi_variable("Commit")) { commit_parameters(GLOBAL_SECTION_SNUM); save_reload(-1); } +output_page: printf("<form name=\"swatform\" method=post action=wizard_params>\n"); + print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name); if (have_write_access) { printf("<input type=submit name=\"Commit\" value=\"Commit Changes\">\n"); |