summaryrefslogtreecommitdiff
path: root/source3
diff options
context:
space:
mode:
authorKai Blin <kai@samba.org>2011-07-08 15:03:15 +0200
committerJeremy Allison <jra@samba.org>2011-07-26 22:22:25 +0200
commitab98edd79dd98c989812ea9eab0418cfcb6bfc86 (patch)
treec1f81d127bd5db817ad6ee1a1c4f528ead39d4e1 /source3
parent00d255fc1d91f2baae9294c838012b9b2cb6dfbc (diff)
downloadsamba-ab98edd79dd98c989812ea9eab0418cfcb6bfc86.tar.gz
samba-ab98edd79dd98c989812ea9eab0418cfcb6bfc86.tar.bz2
samba-ab98edd79dd98c989812ea9eab0418cfcb6bfc86.zip
s3 swat: Add XSRF protection to wizard_params page
Signed-off-by: Kai Blin <kai@samba.org>
Diffstat (limited to 'source3')
-rw-r--r--source3/web/swat.c7
1 files changed, 7 insertions, 0 deletions
diff --git a/source3/web/swat.c b/source3/web/swat.c
index 9366145700..cdbbcb479b 100644
--- a/source3/web/swat.c
+++ b/source3/web/swat.c
@@ -711,18 +711,25 @@ output_page:
static void wizard_params_page(void)
{
unsigned int parm_filter = FLAG_WIZARD;
+ const char form_name[] = "wizard_params";
/* Here we first set and commit all the parameters that were selected
in the previous screen. */
printf("<H2>%s</H2>\n", _("Wizard Parameter Edit Page"));
+ if (!verify_xsrf_token(form_name)) {
+ goto output_page;
+ }
+
if (cgi_variable("Commit")) {
commit_parameters(GLOBAL_SECTION_SNUM);
save_reload(-1);
}
+output_page:
printf("<form name=\"swatform\" method=post action=wizard_params>\n");
+ print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
if (have_write_access) {
printf("<input type=submit name=\"Commit\" value=\"Commit Changes\">\n");