Wavyzz/dolibarr-fork
2
0
Fork 0
forked from Wavyzz/dolibarr
Code Pull Requests Activity

Fix: creation et verification d'un jeton alatoire afin de valider une requete POST, voici la ligne ajouter dans une requete POST

Browse Source 
print '<input type="hidden" name="token" value="'.$_SESSION['newtoken'].'">';
This commit is contained in:
Regis Houssin
2009-05-15 12:48:13 +00:00
parent df37827eb7
commit d73aac6e4e
2 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
htdocs/admin/const.php
View File

@@ -34,12 +34,6 @@ $langs->load("admin");
if (! empty($_SERVER['HTTP_REFERER']) && !eregi(DOL_MAIN_URL_ROOT, $_SERVER['HTTP_REFERER']))
accessforbidden();
//Todo: Verification de la presence et de la validite du jeton pr<70>c<EFBFBD>dent
if (isset($_POST['token']) && isset($_SESSION['oldtoken']))
{
if ($_POST['token'] != $_SESSION['oldtoken']) accessforbidden();
}
if (!$user->admin)
accessforbidden();