diff options
| author | Marc Alexander <admin@m-a-styles.de> | 2020-01-03 17:19:06 +0100 |
|---|---|---|
| committer | Marc Alexander <admin@m-a-styles.de> | 2020-01-03 17:19:06 +0100 |
| commit | 502407a1ddd7a78799ff177e486f4ab85e0abf30 (patch) | |
| tree | de80a2bf8ff7efa98bb20044777e27809615032c | |
| parent | 03757a06635999dd2d7a5ecc968567b90c0b91b4 (diff) | |
| parent | c44c398626e933a89c1b897bd8a71f94a29336a6 (diff) | |
| download | forums-502407a1ddd7a78799ff177e486f4ab85e0abf30.tar forums-502407a1ddd7a78799ff177e486f4ab85e0abf30.tar.gz forums-502407a1ddd7a78799ff177e486f4ab85e0abf30.tar.bz2 forums-502407a1ddd7a78799ff177e486f4ab85e0abf30.tar.xz forums-502407a1ddd7a78799ff177e486f4ab85e0abf30.zip | |
Merge pull request #58 from phpbb/ticket/security-253
[ticket/security-253] Check form key when exporting PM data
| -rw-r--r-- | phpBB/includes/ucp/ucp_pm_viewfolder.php | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/phpBB/includes/ucp/ucp_pm_viewfolder.php b/phpBB/includes/ucp/ucp_pm_viewfolder.php index 09e7bf4d7c..ce40a2507d 100644 --- a/phpBB/includes/ucp/ucp_pm_viewfolder.php +++ b/phpBB/includes/ucp/ucp_pm_viewfolder.php @@ -32,6 +32,8 @@ function view_folder($id, $mode, $folder_id, $folder) $folder_info = get_pm_from($folder_id, $folder, $user->data['user_id']); + add_form_key('ucp_pm_view_folder'); + if (!$submit_export) { $user->add_lang('viewforum'); @@ -197,6 +199,11 @@ function view_folder($id, $mode, $folder_id, $folder) $enclosure = $request->variable('enclosure', ''); $delimiter = $request->variable('delimiter', ''); + if (!check_form_key('ucp_pm_view_folder')) + { + trigger_error('FORM_INVALID'); + } + if ($export_type == 'CSV' && ($delimiter === '' || $enclosure === '')) { $template->assign_var('PROMPT', true); |