summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--profile.php15
-rw-r--r--templates/editprofile.tpl.php1
2 files changed, 16 insertions, 0 deletions
diff --git a/profile.php b/profile.php
index fe86daa..1ad92ba 100644
--- a/profile.php
+++ b/profile.php
@@ -73,6 +73,15 @@ if (isset($_POST['submitted']) && $currentUserID == $userid) {
$detMail = trim($_POST['pMail']);
$detPage = trim($_POST['pPage']);
$detDesc = filter($_POST['pDesc']);
+
+ // manage token preventing from CSRF vulnaribilities
+ if ( !isset($_SESSION['token'], $_SESSION['token_stamp'])
+ || time() - $_SESSION['token_stamp'] > 600 //limit token lifetime, optionnal
+ || $_SESSION['token'] != $_POST['token']) {
+ $error = true;
+ $tplVars['error'] = T_('Invalid Token');
+ }
+
if ($detPass != $detPassConf) {
$error = true;
$tplVars['error'] = T_('Password and confirmation do not match.');
@@ -98,8 +107,14 @@ if (isset($_POST['submitted']) && $currentUserID == $userid) {
if ($currentUserID != $userid) {
$templatename = 'profile.tpl.php';
} else {
+ //Token Init
+ $_SESSION['token'] = md5(uniqid(rand(), true));
+ $_SESSION['token_stamp'] = time();
+
$templatename = 'editprofile.tpl.php';
$tplVars['formaction'] = createURL('profile', $user);
+ $tplVars['token'] = $_SESSION['token'];
+
}
$tplVars['row'] = $userinfo;
diff --git a/templates/editprofile.tpl.php b/templates/editprofile.tpl.php
index a38dbd8..055aab0 100644
--- a/templates/editprofile.tpl.php
+++ b/templates/editprofile.tpl.php
@@ -3,6 +3,7 @@ $this->includeTemplate($GLOBALS['top_include']);
?>
<form action="<?php echo $formaction; ?>" method="post">
+<input type="hidden" name="token" value="<?php echo $token; ?>">
</table>