From d97b4589ade2dbde4048cfdce284f1b5b8bc9c6d Mon Sep 17 00:00:00 2001 From: Christian Weiske Date: Tue, 1 Nov 2011 06:49:40 +0100 Subject: Fix bug #3407728: Can't delete users from admin page --- www/admin.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) (limited to 'www') diff --git a/www/admin.php b/www/admin.php index 1dc21bd..f9b9b8d 100644 --- a/www/admin.php +++ b/www/admin.php @@ -47,8 +47,9 @@ if ( !$currentUser->isAdmin() ) { @list($url, $action, $user) = isset($_SERVER['PATH_INFO']) ? explode('/', $_SERVER['PATH_INFO']) : NULL; -if ( $action -&& (strpos($_SERVER['HTTP_REFERER'], ROOT.'admin') === 0) // Prevent CSRF attacks +if ($action + && (strpos($_SERVER['HTTP_REFERER'], ROOT.'admin') <= 6) + // Prevent CSRF attacks. 6 is needed for "//example.org"-root urls ) { switch ( $action ) { case 'delete': -- cgit v1.2.3