aboutsummaryrefslogtreecommitdiffstats
path: root/Zotlabs
diff options
context:
space:
mode:
authorgit-marijus <mario@mariovavti.com>2017-03-31 13:40:02 +0200
committerGitHub <noreply@github.com>2017-03-31 13:40:02 +0200
commit89e3f3210f5d8ddd49386a5c16320c4d2b909906 (patch)
treec6db28288c69264b0eb962c4caa3569c92dc8cda /Zotlabs
parentdc55c710da8b52c9a8e60663ad00aae28bbc8c6b (diff)
parent81736a01299f7c963e361e9b192df074999d16d8 (diff)
downloadvolse-hubzilla-89e3f3210f5d8ddd49386a5c16320c4d2b909906.tar.gz
volse-hubzilla-89e3f3210f5d8ddd49386a5c16320c4d2b909906.tar.bz2
volse-hubzilla-89e3f3210f5d8ddd49386a5c16320c4d2b909906.zip
Merge pull request #710 from dawnbreak/importcsrf
:lock: Add CSRF protection for import and import_items.
Diffstat (limited to 'Zotlabs')
-rw-r--r--Zotlabs/Module/Import.php3
-rw-r--r--Zotlabs/Module/Import_items.php3
2 files changed, 6 insertions, 0 deletions
diff --git a/Zotlabs/Module/Import.php b/Zotlabs/Module/Import.php
index b98c9be9b..54bc7de81 100644
--- a/Zotlabs/Module/Import.php
+++ b/Zotlabs/Module/Import.php
@@ -478,6 +478,8 @@ class Import extends \Zotlabs\Web\Controller {
if(! $account_id)
return;
+ check_form_security_token_redirectOnErr('/import', 'channel_import');
+
$this->import_account($account_id);
}
@@ -508,6 +510,7 @@ class Import extends \Zotlabs\Web\Controller {
'$pleasewait' => t('This process may take several minutes to complete. Please submit the form only once and leave this page open until finished.'),
'$email' => '',
'$pass' => '',
+ '$form_security_token' => get_form_security_token('channel_import'),
'$submit' => t('Submit')
));
diff --git a/Zotlabs/Module/Import_items.php b/Zotlabs/Module/Import_items.php
index 133e37d9e..c2b2506fe 100644
--- a/Zotlabs/Module/Import_items.php
+++ b/Zotlabs/Module/Import_items.php
@@ -15,6 +15,8 @@ class Import_items extends \Zotlabs\Web\Controller {
if(! local_channel())
return;
+ check_form_security_token_redirectOnErr('/import_items', 'import_items');
+
$data = null;
$src = $_FILES['filename']['tmp_name'];
@@ -123,6 +125,7 @@ class Import_items extends \Zotlabs\Web\Controller {
'$title' => t('Import Items'),
'$desc' => t('Use this form to import existing posts and content from an export file.'),
'$label_filename' => t('File to Upload'),
+ '$form_security_token' => get_form_security_token('import_items'),
'$submit' => t('Submit')
));