merge r4493 from trunk to branch 2.0

Bug 1328 : improve check function


git-svn-id: http://piwigo.org/svn/branches/2.0@4502 68402e56-0260-453c-a942-63ccdbb3a9ee

1 files changed, 9 insertions, 4 deletions

diff --git a/admin/include/functions.php b/admin/include/functions.php
index 1538a98ae..39e2e5d35 100644
--- a/admin/include/functions.php
+++ b/admin/include/functions.php
@@ -34,13 +34,18 @@ function check_token()
 {
   global $conf;
 
-  $token = hash_hmac('md5', session_id(), $conf['secret_key']);
+  $valid_token = hash_hmac('md5', session_id(), $conf['secret_key']);
+  $given_token = null;
 
-  if (!empty($_POST['pwg_token']) && ($_POST['pwg_token'] != $token))
+  if (!empty($_POST['pwg_token']))
   {
-    access_denied();    
+    $given_token = $_POST['pwg_token'];
+  }
+  elseif (!empty($_GET['pwg_token']))
+  {
+    $given_token = $_GET['pwg_token'];
   }
-  elseif (!empty($_GET['pwg_token']) && ($_GET['pwg_token'] != $token))
+  if ($given_token != $valid_token)
   {
     access_denied();    
   }