summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEvan Prodromou <evan@prodromou.name>2008-08-29 01:40:17 -0400
committerEvan Prodromou <evan@prodromou.name>2008-08-29 01:40:17 -0400
commit2dc50d7e3768548c78f095903388d53a5bee373f (patch)
tree09828d854a600d1f8a6150163d90dbf89687a140
parent47726844a0ceef6fc4697aca710c8e1bee5bf7f5 (diff)
CSRF protection in user registration
darcs-hash:20080829054017-84dde-c9268e5c815934dcbca2451dd6c9016f2ac4a03a.gz
-rw-r--r--actions/register.php8
1 files changed, 8 insertions, 0 deletions
diff --git a/actions/register.php b/actions/register.php
index e6b1931ce..aee99b693 100644
--- a/actions/register.php
+++ b/actions/register.php
@@ -36,6 +36,13 @@ class RegisterAction extends Action {
}
function try_register() {
+
+ $token = $this->trimmed('token');
+ if (!$token || $token != common_session_token()) {
+ $this->show_form(_('There was a problem with your session token. Try again, please.'));
+ return;
+ }
+
$nickname = $this->trimmed('nickname');
$email = $this->trimmed('email');
$fullname = $this->trimmed('fullname');
@@ -139,6 +146,7 @@ class RegisterAction extends Action {
common_element_start('form', array('method' => 'post',
'id' => 'login',
'action' => common_local_url('register')));
+ common_hidden('token', common_session_token());
common_input('nickname', _('Nickname'), $this->trimmed('nickname'),
_('1-64 lowercase letters or numbers, no punctuation or spaces. Required.'));
common_password('password', _('Password'),