gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2024-11-26 15:32:13 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

add csrf protection

Browse Source
This commit is contained in:
Uwe Steinmann 2021-01-25 10:04:45 +01:00
parent dc3cd2e1de
commit cb4cd22caf
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
op/op.AddDocumentLink.php
View File

@ -28,6 +28,11 @@ include("../inc/inc.DBInit.php");
include("../inc/inc.ClassUI.php");
include("../inc/inc.Authentication.php");
/* Check if the form data comes from a trusted request */
if(!checkFormKey('adddocumentlink', 'GET')) {
UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_request_token"))),getMLText("invalid_request_token"));
}
if (!isset($_GET["documentid"]) || !is_numeric($_GET["documentid"]) || intval($_GET["documentid"])<1) {
UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id"));
}

1
views/bootstrap/class.ViewDocument.php
View File

@ -1467,6 +1467,7 @@ class SeedDMS_View_ViewDocument extends SeedDMS_Bootstrap_Style {
<br>
<form action="../op/op.AddDocumentLink.php" name="form1" class="form-horizontal">
<input type="hidden" name="documentid" value="<?php print $documentid;?>">
<?php echo createHiddenFieldWithKey('adddocumentlink'); ?>
<?php $this->formField(getMLText("add_document_link"), $this->getDocumentChooserHtml("form1")); ?>
<?php
if ($document->getAccessMode($user) >= M_READWRITE) {