makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-28 14:18:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #57 from phpbb/ticket/security-251

Browse source 
[ticket/security-251] Check form token when moving PM to folder
This commit is contained in:
Marc Alexander 2020-01-03 17:22:43 +01:00
commit 3aa4b67173
No known key found for this signature in database
GPG key ID: 50E0D2423696F995
1 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
phpBB/includes/ucp/ucp_pm.php
View file

@ -193,6 +193,8 @@ class ucp_pm
trigger_error('NO_AUTH_READ_HOLD_MESSAGE'); trigger_error('NO_AUTH_READ_HOLD_MESSAGE');
} }
add_form_key('ucp_pm_view');
// First Handle Mark actions and moving messages // First Handle Mark actions and moving messages
$submit_mark = (isset($_POST['submit_mark'])) ? true : false; $submit_mark = (isset($_POST['submit_mark'])) ? true : false;
$move_pm = (isset($_POST['move_pm'])) ? true : false; $move_pm = (isset($_POST['move_pm'])) ? true : false;
@ -207,6 +209,11 @@ class ucp_pm
$submit_mark = false; $submit_mark = false;
} }
if (($move_pm || $submit_mark) && !check_form_key('ucp_pm_view'))
{
trigger_error('FORM_INVALID');
}
// Move PM // Move PM
if ($move_pm) if ($move_pm)
{ {