summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEvan Prodromou <evan@controlyourself.ca>2008-09-22 23:14:19 -0400
committerEvan Prodromou <evan@controlyourself.ca>2008-09-22 23:14:19 -0400
commitd2fb829296f61bdd4bef281db440bdba67840554 (patch)
treed6377f0f3be817cab27df7789590670a77dcca09
parent6e646570ded571e86dda2941201537dbaedee96a (diff)
CSRF protection in newmessage.php
darcs-hash:20080923031419-5ed1f-5435509496b882de27d4c3acca4697cc410ee7be.gz
-rw-r--r--actions/newmessage.php10
1 files changed, 10 insertions, 0 deletions
diff --git a/actions/newmessage.php b/actions/newmessage.php
index 5aa363323..e223ed8ff 100644
--- a/actions/newmessage.php
+++ b/actions/newmessage.php
@@ -37,6 +37,14 @@ class NewmessageAction extends Action {
$user = common_current_user();
assert($user); # XXX: maybe an error instead...
+
+ # CSRF protection
+
+ $token = $this->trimmed('token');
+ if (!$token || $token != common_session_token()) {
+ $this->show_form(_('There was a problem with your session token. Try again, please.'));
+ return;
+ }
$content = $this->trimmed('content');
$to = $this->trimmed('to');
@@ -117,6 +125,8 @@ class NewmessageAction extends Action {
'type' => 'submit',
'value' => _('Send')));
+ common_hidden('token', common_session_token());
+
common_element_end('p');
common_element_end('form');
}