summaryrefslogtreecommitdiff
path: root/source3
diff options
context:
space:
mode:
authorKai Blin <kai@samba.org>2011-07-08 15:04:48 +0200
committerJeremy Allison <jra@samba.org>2011-07-26 22:22:25 +0200
commitc02df79f610d69d5311b7659f94d9161e88836ee (patch)
tree8eb94943fcb349f3ca63ad783d3f285100f0a0f8 /source3
parent68f8924c7c9157e4a324c77695fbf0e07635fb32 (diff)
downloadsamba-c02df79f610d69d5311b7659f94d9161e88836ee.tar.gz
samba-c02df79f610d69d5311b7659f94d9161e88836ee.tar.bz2
samba-c02df79f610d69d5311b7659f94d9161e88836ee.zip
s3 swat: Add XSRF protection to shares page
Signed-off-by: Kai Blin <kai@samba.org>
Diffstat (limited to 'source3')
-rw-r--r--source3/web/swat.c18
1 files changed, 13 insertions, 5 deletions
diff --git a/source3/web/swat.c b/source3/web/swat.c
index 7ce6893af1..2ad2870adc 100644
--- a/source3/web/swat.c
+++ b/source3/web/swat.c
@@ -996,11 +996,17 @@ static void shares_page(void)
int mode = 0;
unsigned int parm_filter = FLAG_BASIC;
size_t converted_size;
+ const char form_name[] = "shares";
+
+ printf("<H2>%s</H2>\n", _("Share Parameters"));
+
+ if (!verify_xsrf_token(form_name)) {
+ goto output_page;
+ }
if (share)
snum = lp_servicenumber(share);
- printf("<H2>%s</H2>\n", _("Share Parameters"));
if (cgi_variable("Commit") && snum >= 0) {
commit_parameters(snum);
@@ -1026,10 +1032,6 @@ static void shares_page(void)
}
}
- printf("<FORM name=\"swatform\" method=post>\n");
-
- printf("<table>\n");
-
if ( cgi_variable("ViewMode") )
mode = atoi(cgi_variable_nonull("ViewMode"));
if ( cgi_variable("BasicMode"))
@@ -1037,6 +1039,12 @@ static void shares_page(void)
if ( cgi_variable("AdvMode"))
mode = 1;
+output_page:
+ printf("<FORM name=\"swatform\" method=post>\n");
+ print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
+
+ printf("<table>\n");
+
ViewModeBoxes( mode );
switch ( mode ) {
case 0: