diff options
Diffstat (limited to 'actions/avatar.php')
| -rw-r--r-- | actions/avatar.php | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/actions/avatar.php b/actions/avatar.php index ebfbd7295..9f397e93c 100644 --- a/actions/avatar.php +++ b/actions/avatar.php @@ -58,6 +58,7 @@ class AvatarAction extends SettingsAction { 'id' => 'avatar', 'action' => common_local_url('avatar'))); + common_hidden('token', common_session_token()); common_element('input', array('name' => 'MAX_FILE_SIZE', 'type' => 'hidden', 'id' => 'MAX_FILE_SIZE', @@ -72,6 +73,14 @@ class AvatarAction extends SettingsAction { function handle_post() { + # CSRF protection + + $token = $this->trimmed('token'); + if (!$token || $token != common_session_token()) { + $this->show_form(_('There was a problem with your session token. Try again, please.')); + return; + } + switch ($_FILES['avatarfile']['error']) { case UPLOAD_ERR_OK: # success, jump out break; |