lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix MAIN_SECURITY_CSRF. Renamed into MAIN_SECURITY_CSRF_WITH_TOKEN

Browse Source 
So option name is easier to understand.
This commit is contained in:
Laurent Destailleur 2016-09-08 10:40:30 +02:00
parent 4a49bc1d08
commit 69b65ad00c
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
htdocs/main.inc.php
View File

@ -302,11 +302,11 @@ if (! defined('NOTOKENRENEWAL'))
if (isset($_SESSION['newtoken'])) $_SESSION['token'] = $_SESSION['newtoken']; if (isset($_SESSION['newtoken'])) $_SESSION['token'] = $_SESSION['newtoken'];
$_SESSION['newtoken'] = $token; $_SESSION['newtoken'] = $token;
} }
if (! empty($conf->global->MAIN_SECURITY_CSRF)) // Check validity of token, only if option enabled (this option breaks some features sometimes) if (! defined('NOCSRFCHECK') && empty($dolibarr_nocsrfcheck) && ! empty($conf->global->MAIN_SECURITY_CSRF_WITH_TOKEN)) // Check validity of token, only if option enabled (this option breaks some features sometimes)
{ {
if (isset($_POST['token']) && isset($_SESSION['token'])) if ($_SERVER['REQUEST_METHOD'] === 'POST')
{ {
if (($_POST['token'] != $_SESSION['token'])) if (GETPOST('token') != $_SESSION['token'])
{ {
dol_syslog("Invalid token in ".$_SERVER['HTTP_REFERER'].", action=".GETPOST('action').", _POST['token']=".GETPOST('token').", _SESSION['token']=".$_SESSION['token'], LOG_WARNING); dol_syslog("Invalid token in ".$_SERVER['HTTP_REFERER'].", action=".GETPOST('action').", _POST['token']=".GETPOST('token').", _SESSION['token']=".$_SESSION['token'], LOG_WARNING);
//print 'Unset POST by CSRF protection in main.inc.php.'; // Do not output anything because this create problems when using the BACK button on browsers. //print 'Unset POST by CSRF protection in main.inc.php.'; // Do not output anything because this create problems when using the BACK button on browsers.