summaryrefslogtreecommitdiff
path: root/web/lib
diff options
context:
space:
mode:
authorLukas Fleischer <archlinux@cryptocrack.de>2012-07-14 22:47:04 +0200
committerLukas Fleischer <archlinux@cryptocrack.de>2012-07-14 22:52:04 +0200
commitf3ce74c714e3460bb3e3e786f626e397d3139062 (patch)
tree0750fca34c23a6476475069ff823b0bafe059567 /web/lib
parent857de725d1c87da005b4ab8e9a88222fd19aab4b (diff)
parent50e97446bbcc605768811fee387efe724b84e042 (diff)
Merge branch 'maint'
Conflicts: web/html/account.php web/html/addvote.php web/html/pkgsubmit.php web/lib/acctfuncs.inc.php web/template/actions_form.php web/template/pkg_comment_form.php web/template/pkg_comments.php web/template/pkg_details.php web/template/pkg_search_results.php web/template/tu_details.php
Diffstat (limited to 'web/lib')
-rw-r--r--web/lib/acctfuncs.inc.php2
-rw-r--r--web/lib/aur.inc.php10
-rw-r--r--web/lib/pkgfuncs.inc.php2
3 files changed, 12 insertions, 2 deletions
diff --git a/web/lib/acctfuncs.inc.php b/web/lib/acctfuncs.inc.php
index 59f499e..a41a4e7 100644
--- a/web/lib/acctfuncs.inc.php
+++ b/web/lib/acctfuncs.inc.php
@@ -624,7 +624,7 @@ function user_suspended($id, $dbh=NULL) {
$result = db_query($q, $dbh);
if ($result) {
$row = mysql_fetch_row($result);
- if ($result[0] == 1 ) {
+ if ($row[0]) {
return true;
}
}
diff --git a/web/lib/aur.inc.php b/web/lib/aur.inc.php
index 5a70e77..1a6164e 100644
--- a/web/lib/aur.inc.php
+++ b/web/lib/aur.inc.php
@@ -75,6 +75,16 @@ function check_sid($dbh=NULL) {
return;
}
+# Verify the supplied token matches the expected token for POST forms
+#
+function check_token() {
+ if (isset($_POST['token'])) {
+ return ($_POST['token'] == $_COOKIE['AURSID']);
+ } else {
+ return false;
+ }
+}
+
# verify that an email address looks like it is legitimate
#
function valid_email($addy) {
diff --git a/web/lib/pkgfuncs.inc.php b/web/lib/pkgfuncs.inc.php
index 6d2f01f..0009b93 100644
--- a/web/lib/pkgfuncs.inc.php
+++ b/web/lib/pkgfuncs.inc.php
@@ -395,7 +395,7 @@ function package_details($id=0, $SID="", $dbh=NULL) {
# Actions Bar
if ($SID) {
include('actions_form.php');
- if (isset($_REQUEST['comment'])) {
+ if (isset($_REQUEST['comment']) && check_token()) {
$uid = uid_from_sid($SID, $dbh);
add_package_comment($id, $uid, $_REQUEST['comment'], $dbh);
}