makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-28 14:18:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #58 from phpbb/ticket/security-253

Browse source 
[ticket/security-253] Check form key when exporting PM data
This commit is contained in:
Marc Alexander 2020-01-03 17:19:06 +01:00
commit 502407a1dd
No known key found for this signature in database
GPG key ID: 50E0D2423696F995
1 changed files with 7 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
phpBB/includes/ucp/ucp_pm_viewfolder.php
View file

@ -32,6 +32,8 @@ function view_folder($id, $mode, $folder_id, $folder)
$folder_info = get_pm_from($folder_id, $folder, $user->data['user_id']); $folder_info = get_pm_from($folder_id, $folder, $user->data['user_id']);
add_form_key('ucp_pm_view_folder');
if (!$submit_export) if (!$submit_export)
{ {
$user->add_lang('viewforum'); $user->add_lang('viewforum');
@ -197,6 +199,11 @@ function view_folder($id, $mode, $folder_id, $folder)
$enclosure = $request->variable('enclosure', ''); $enclosure = $request->variable('enclosure', '');
$delimiter = $request->variable('delimiter', ''); $delimiter = $request->variable('delimiter', '');
if (!check_form_key('ucp_pm_view_folder'))
{
trigger_error('FORM_INVALID');
}
if ($export_type == 'CSV' && ($delimiter === '' || $enclosure === '')) if ($export_type == 'CSV' && ($delimiter === '' || $enclosure === ''))
{ {
$template->assign_var('PROMPT', true); $template->assign_var('PROMPT', true);