archive/piwigo
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

merge r20713 from branch 2.4 to trunk

Browse source 
bug 2844: improve security on LocalFiles Editor, add pwg_token to avoid CSRF



git-svn-id: http://piwigo.org/svn/trunk@20715 68402e56-0260-453c-a942-63ccdbb3a9ee
This commit is contained in:
plegall 2013-02-12 10:21:03 +00:00
commit 758f29eb7d
2 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
plugins/LocalFilesEditor/admin.php
View file

@ -66,6 +66,8 @@ if (isset($_POST['restore']))
// +-----------------------------------------------------------------------+
if (isset($_POST['submit']))
{
check_pwg_token();
if (!is_webmaster())
{
array_push($page['errors'], l10n('locfiledit_webmaster_only'));
@ -140,6 +142,7 @@ if (!empty($edited_file))
$template->assign(array(
'F_ACTION' => PHPWG_ROOT_PATH.'admin.php?page=plugin-LocalFilesEditor-'.$page['tab'],
'LOCALEDIT_PATH' => LOCALEDIT_PATH,
'PWG_TOKEN' => get_pwg_token(),
'CODEMIRROR_MODE' => @$codemirror_mode
)
);