Mirrors/dolibarr
1
0
Fork 0
mirror of https://github.com/Dolibarr/dolibarr.git synced 2025-02-20 13:46:52 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix MAIN_SECURITY_CSRF. Renamed into MAIN_SECURITY_CSRF_WITH_TOKEN

Browse Source 
So option name is easier to understand.
This commit is contained in:
Laurent Destailleur 2016-09-08 10:40:30 +02:00
parent 4a49bc1d08
commit 69b65ad00c
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
htdocs/main.inc.php
View File

@ -302,13 +302,13 @@ if (! defined('NOTOKENRENEWAL'))
if (isset($_SESSION['newtoken'])) $_SESSION['token'] = $_SESSION['newtoken'];
$_SESSION['newtoken'] = $token;
}
if (! empty($conf->global->MAIN_SECURITY_CSRF)) // Check validity of token, only if option enabled (this option breaks some features sometimes)
if (! defined('NOCSRFCHECK') && empty($dolibarr_nocsrfcheck) && ! empty($conf->global->MAIN_SECURITY_CSRF_WITH_TOKEN)) // Check validity of token, only if option enabled (this option breaks some features sometimes)
{
if (isset($_POST['token']) && isset($_SESSION['token']))
if ($_SERVER['REQUEST_METHOD'] === 'POST')
{
if (($_POST['token'] != $_SESSION['token']))
if (GETPOST('token') != $_SESSION['token'])
{
dol_syslog("Invalid token in ".$_SERVER['HTTP_REFERER'].", action=".GETPOST('action').", _POST['token']=".GETPOST('token').", _SESSION['token']=".$_SESSION['token'],LOG_WARNING);
dol_syslog("Invalid token in ".$_SERVER['HTTP_REFERER'].", action=".GETPOST('action').", _POST['token']=".GETPOST('token').", _SESSION['token']=".$_SESSION['token'], LOG_WARNING);
//print 'Unset POST by CSRF protection in main.inc.php.'; // Do not output anything because this create problems when using the BACK button on browsers.
unset($_POST);
}