CSRF protection in newmessage.php

darcs-hash:20080923031419-5ed1f-5435509496b882de27d4c3acca4697cc410ee7be.gz

1 files changed, 10 insertions, 0 deletions

diff --git a/actions/newmessage.php b/actions/newmessage.php
index 5aa363323..e223ed8ff 100644
--- a/actions/newmessage.php
+++ b/actions/newmessage.php
@@ -37,6 +37,14 @@ class NewmessageAction extends Action {
 
 		$user = common_current_user();
 		assert($user); # XXX: maybe an error instead...
+
+		# CSRF protection
+		
+		$token = $this->trimmed('token');
+		if (!$token || $token != common_session_token()) {
+			$this->show_form(_('There was a problem with your session token. Try again, please.'));
+			return;
+		}
 		
 		$content = $this->trimmed('content');
 		$to = $this->trimmed('to');
@@ -117,6 +125,8 @@ class NewmessageAction extends Action {
 									  'type' => 'submit',
 									  'value' => _('Send')));
 		
+		common_hidden('token', common_session_token());
+		
 		common_element_end('p');
 		common_element_end('form');
 	}