diff options
| author | Zach Copley <zach@status.net> | 2009-11-16 18:12:39 -0800 |
|---|---|---|
| committer | Zach Copley <zach@status.net> | 2010-01-14 02:41:04 +0000 |
| commit | 4c5ddc42c10f2c8509e2a38e3fb18a69e021213a (patch) | |
| tree | ea54f102dafcde232040d9e24ea0847a45bec18b /actions/newapplication.php | |
| parent | dad67b030f395816db4ba32cef56e848aea93f96 (diff) | |
Added session token checking.
Diffstat (limited to 'actions/newapplication.php')
| -rw-r--r-- | actions/newapplication.php | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/actions/newapplication.php b/actions/newapplication.php index 9d8635270..ec0f2e7af 100644 --- a/actions/newapplication.php +++ b/actions/newapplication.php @@ -84,6 +84,13 @@ class NewApplicationAction extends OwnerDesignAction if ($_SERVER['REQUEST_METHOD'] == 'POST') { + // CSRF protection + $token = $this->trimmed('token'); + if (!$token || $token != common_session_token()) { + $this->clientError(_('There was a problem with your session token.')); + return; + } + $cur = common_current_user(); if ($this->arg('cancel')) { |