summaryrefslogtreecommitdiff
path: root/actions/newapplication.php
diff options
context:
space:
mode:
authorZach Copley <zach@status.net>2009-11-16 18:12:39 -0800
committerZach Copley <zach@status.net>2010-01-14 02:41:04 +0000
commit4c5ddc42c10f2c8509e2a38e3fb18a69e021213a (patch)
treeea54f102dafcde232040d9e24ea0847a45bec18b /actions/newapplication.php
parentdad67b030f395816db4ba32cef56e848aea93f96 (diff)
Added session token checking.
Diffstat (limited to 'actions/newapplication.php')
-rw-r--r--actions/newapplication.php7
1 files changed, 7 insertions, 0 deletions
diff --git a/actions/newapplication.php b/actions/newapplication.php
index 9d8635270..ec0f2e7af 100644
--- a/actions/newapplication.php
+++ b/actions/newapplication.php
@@ -84,6 +84,13 @@ class NewApplicationAction extends OwnerDesignAction
if ($_SERVER['REQUEST_METHOD'] == 'POST') {
+ // CSRF protection
+ $token = $this->trimmed('token');
+ if (!$token || $token != common_session_token()) {
+ $this->clientError(_('There was a problem with your session token.'));
+ return;
+ }
+
$cur = common_current_user();
if ($this->arg('cancel')) {