diff options
| author | Evan Prodromou <evan@prodromou.name> | 2008-08-29 01:40:17 -0400 |
|---|---|---|
| committer | Evan Prodromou <evan@prodromou.name> | 2008-08-29 01:40:17 -0400 |
| commit | 2dc50d7e3768548c78f095903388d53a5bee373f (patch) | |
| tree | 09828d854a600d1f8a6150163d90dbf89687a140 /actions/register.php | |
| parent | 47726844a0ceef6fc4697aca710c8e1bee5bf7f5 (diff) | |
CSRF protection in user registration
darcs-hash:20080829054017-84dde-c9268e5c815934dcbca2451dd6c9016f2ac4a03a.gz
Diffstat (limited to 'actions/register.php')
| -rw-r--r-- | actions/register.php | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/actions/register.php b/actions/register.php index e6b1931ce..aee99b693 100644 --- a/actions/register.php +++ b/actions/register.php @@ -36,6 +36,13 @@ class RegisterAction extends Action { } function try_register() { + + $token = $this->trimmed('token'); + if (!$token || $token != common_session_token()) { + $this->show_form(_('There was a problem with your session token. Try again, please.')); + return; + } + $nickname = $this->trimmed('nickname'); $email = $this->trimmed('email'); $fullname = $this->trimmed('fullname'); @@ -139,6 +146,7 @@ class RegisterAction extends Action { common_element_start('form', array('method' => 'post', 'id' => 'login', 'action' => common_local_url('register'))); + common_hidden('token', common_session_token()); common_input('nickname', _('Nickname'), $this->trimmed('nickname'), _('1-64 lowercase letters or numbers, no punctuation or spaces. Required.')); common_password('password', _('Password'), |