From 4129711e9f9b67ea102594254434f6210cd03e81 Mon Sep 17 00:00:00 2001 From: Dhruv Goel Date: Sun, 1 Apr 2012 16:57:46 +0530 Subject: [PATCH] [feature/delete-auto-logins] checks form key The form key is checked after submission if not correct error is returned. PHPBB3-9647 --- phpBB/includes/ucp/ucp_profile.php | 33 +++++++++++++++++++++--------- 1 file changed, 23 insertions(+), 10 deletions(-) diff --git a/phpBB/includes/ucp/ucp_profile.php b/phpBB/includes/ucp/ucp_profile.php index 2595e48fb5..d4e5d75c10 100644 --- a/phpBB/includes/ucp/ucp_profile.php +++ b/phpBB/includes/ucp/ucp_profile.php @@ -627,18 +627,29 @@ class ucp_profile { $keys = request_var('keys', array('')); - if (!empty($keys)) + if (!check_form_key('ucp_autologin_keys')) { - $sql = 'DELETE FROM ' . SESSIONS_KEYS_TABLE . ' - WHERE user_id = ' . (int) $user->data['user_id'] . ' - AND ' . $db->sql_in_set('key_id', $keys) ; - - $db->sql_query($sql); - - meta_refresh(3, $this->u_action); - $message = $user->lang['AUTOLOGIN_SESSION_KEYS_DELETED'] . '

' . sprintf($user->lang['RETURN_UCP'], '', ''); - trigger_error($message); + $error[] = 'FORM_INVALID'; } + + if (!sizeof($error)) + { + if (!empty($keys)) + { + $sql = 'DELETE FROM ' . SESSIONS_KEYS_TABLE . ' + WHERE user_id = ' . (int) $user->data['user_id'] . ' + AND ' . $db->sql_in_set('key_id', $keys) ; + + $db->sql_query($sql); + + meta_refresh(3, $this->u_action); + $message = $user->lang['AUTOLOGIN_SESSION_KEYS_DELETED'] . '

' . sprintf($user->lang['RETURN_UCP'], '', ''); + trigger_error($message); + } + } + + // Replace "error" strings with their real, localised form + $error = array_map(array($user, 'lang'), $error); } $sql = 'SELECT key_id, last_ip, last_login @@ -650,6 +661,8 @@ class ucp_profile while ($row = $db->sql_fetchrow($result)) { $template->assign_block_vars('sessions', array( + 'ERROR' => (sizeof($error)) ? implode('
', $error) : '', + 'KEY' => $row['key_id'], 'IP' => $row['last_ip'], 'LOGIN_TIME' => $row['last_login'],