makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-28 06:08:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

[ticket/security-252] Check form token on marking PM

Browse source 
SECURITY-252
This commit is contained in:
Marc Alexander 2019-12-26 14:40:23 +01:00
parent e7a6ed20e8
commit 25c80df156
No known key found for this signature in database
GPG key ID: 50E0D2423696F995
1 changed files with 5 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
phpBB/includes/ucp/ucp_pm.php
View file

@ -209,14 +209,14 @@ class ucp_pm
$submit_mark = false;
}
// Move PM
if ($move_pm)
{
if (!check_form_key('ucp_pm_view'))
if (($move_pm || $submit_mark) && !check_form_key('ucp_pm_view'))
{
trigger_error('FORM_INVALID');
}
// Move PM
if ($move_pm)
{
$move_msg_ids = (isset($_POST['marked_msg_id'])) ? $request->variable('marked_msg_id', array(0)) : array();
$cur_folder_id = $request->variable('cur_folder_id', PRIVMSGS_NO_BOX);