From 5af0cfd99a13fda9afad3380b0c50a3428acd299 Mon Sep 17 00:00:00 2001 From: Till Brehm <tbrehm@ispconfig.org> Date: Wed, 03 Jun 2015 12:14:07 -0400 Subject: [PATCH] Extended the CSRF check. --- interface/web/admin/language_import.php | 9 +++++++++ 1 files changed, 9 insertions(+), 0 deletions(-) diff --git a/interface/web/admin/language_import.php b/interface/web/admin/language_import.php index d53575b..00d105c 100644 --- a/interface/web/admin/language_import.php +++ b/interface/web/admin/language_import.php @@ -129,6 +129,10 @@ // Export the language file if(isset($_FILES['file']['name']) && is_uploaded_file($_FILES['file']['tmp_name'])) { + + //* CSRF Check + $app->auth->csrf_token_check(); + $lines = file($_FILES['file']['tmp_name']); // initial check $parts = explode('|', $lines[0]); @@ -183,6 +187,11 @@ $app->tpl->setVar('msg', $msg); $app->tpl->setVar('error', $error); +//* SET csrf token +$csrf_token = $app->auth->csrf_token_get('language_import'); +$app->tpl->setVar('_csrf_id',$csrf_token['csrf_id']); +$app->tpl->setVar('_csrf_key',$csrf_token['csrf_key']); + //* load language file $lng_file = 'lib/lang/'.$_SESSION['s']['language'].'_language_import.lng'; include $lng_file; -- Gitblit v1.9.1