diff options
| author | Marc Alexander <admin@m-a-styles.de> | 2016-09-30 23:26:04 +0100 |
|---|---|---|
| committer | Marc Alexander <admin@m-a-styles.de> | 2016-09-30 23:26:04 +0100 |
| commit | 4e5f29a21b79f58864669e0d1a62fa8287e11720 (patch) | |
| tree | bb6c794f5fb28c6a6adb52d2e930a64e537fdd02 /phpBB/includes/acp | |
| parent | 88d7c4fe57eb0255c6c5cb434f3a3aaa0f6e726c (diff) | |
| download | forums-4e5f29a21b79f58864669e0d1a62fa8287e11720.tar forums-4e5f29a21b79f58864669e0d1a62fa8287e11720.tar.gz forums-4e5f29a21b79f58864669e0d1a62fa8287e11720.tar.bz2 forums-4e5f29a21b79f58864669e0d1a62fa8287e11720.tar.xz forums-4e5f29a21b79f58864669e0d1a62fa8287e11720.zip | |
[ticket/14789] Remove obsolete check_form_key() and add missing hashes
PHPBB3-14789
Diffstat (limited to 'phpBB/includes/acp')
| -rw-r--r-- | phpBB/includes/acp/acp_database.php | 5 | ||||
| -rw-r--r-- | phpBB/includes/acp/acp_users.php | 10 |
2 files changed, 8 insertions, 7 deletions
diff --git a/phpBB/includes/acp/acp_database.php b/phpBB/includes/acp/acp_database.php index a54ba76358..dd0599e06a 100644 --- a/phpBB/includes/acp/acp_database.php +++ b/phpBB/includes/acp/acp_database.php @@ -233,11 +233,6 @@ class acp_database $file = request_var('file', ''); $download = request_var('download', ''); - if (!check_form_key($form_key)) - { - trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING); - } - if (!preg_match('#^backup_\d{10,}_[a-z\d]{16}\.(sql(?:\.(?:gz|bz2))?)$#', $file, $matches)) { trigger_error($user->lang['BACKUP_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING); diff --git a/phpBB/includes/acp/acp_users.php b/phpBB/includes/acp/acp_users.php index 1ea266815d..1e453e88ad 100644 --- a/phpBB/includes/acp/acp_users.php +++ b/phpBB/includes/acp/acp_users.php @@ -2274,6 +2274,12 @@ class acp_users { trigger_error($user->lang['NO_GROUP'] . adm_back_link($this->u_action . '&u=' . $user_id), E_USER_WARNING); } + + if (!check_link_hash($request->variable('hash', ''), 'acp_users')) + { + trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING); + } + group_user_attributes($action, $group_id, $user_id); if ($action == 'default') @@ -2431,8 +2437,8 @@ class acp_users { $template->assign_block_vars('group', array( 'U_EDIT_GROUP' => append_sid("{$phpbb_admin_path}index.$phpEx", "i=groups&mode=manage&action=edit&u=$user_id&g={$data['group_id']}&back_link=acp_users_groups"), - 'U_DEFAULT' => $this->u_action . "&action=default&u=$user_id&g=" . $data['group_id'], - 'U_DEMOTE_PROMOTE' => $this->u_action . '&action=' . (($data['group_leader']) ? 'demote' : 'promote') . "&u=$user_id&g=" . $data['group_id'], + 'U_DEFAULT' => $this->u_action . "&action=default&u=$user_id&g=" . $data['group_id'] . '&hash=' . generate_link_hash('acp_users'), + 'U_DEMOTE_PROMOTE' => $this->u_action . '&action=' . (($data['group_leader']) ? 'demote' : 'promote') . "&u=$user_id&g=" . $data['group_id'] . '&hash=' . generate_link_hash('acp_users'), 'U_DELETE' => $this->u_action . "&action=delete&u=$user_id&g=" . $data['group_id'], 'U_APPROVE' => ($group_type == 'pending') ? $this->u_action . "&action=approve&u=$user_id&g=" . $data['group_id'] : '', |