diff options
| author | Marc Alexander <admin@m-a-styles.de> | 2019-08-25 18:27:30 +0200 |
|---|---|---|
| committer | Marc Alexander <admin@m-a-styles.de> | 2019-08-25 18:27:30 +0200 |
| commit | 26215517dd04434333bddbc06b9ae92a845fb494 (patch) | |
| tree | 4ee2d4591ce8544a3361ff6d36010df39ba30cf0 /phpBB/includes/acp | |
| parent | 31aeac574517add62a4312c3ec490a1e70f5ebd9 (diff) | |
| parent | cdf4f5ef85f05c0f94eae1a9edb1c28d4ac3515f (diff) | |
| download | forums-26215517dd04434333bddbc06b9ae92a845fb494.tar forums-26215517dd04434333bddbc06b9ae92a845fb494.tar.gz forums-26215517dd04434333bddbc06b9ae92a845fb494.tar.bz2 forums-26215517dd04434333bddbc06b9ae92a845fb494.tar.xz forums-26215517dd04434333bddbc06b9ae92a845fb494.zip | |
Merge pull request #50 from phpbb/ticket/security/246
[ticket/security/246] Check form key no matter if submit is set
Diffstat (limited to 'phpBB/includes/acp')
| -rw-r--r-- | phpBB/includes/acp/acp_bbcodes.php | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/phpBB/includes/acp/acp_bbcodes.php b/phpBB/includes/acp/acp_bbcodes.php index 1f7374a07f..56079061ce 100644 --- a/phpBB/includes/acp/acp_bbcodes.php +++ b/phpBB/includes/acp/acp_bbcodes.php @@ -33,7 +33,6 @@ class acp_bbcodes // Set up general vars $action = $request->variable('action', ''); $bbcode_id = $request->variable('bbcode', 0); - $submit = $request->is_set_post('submit'); $this->tpl_name = 'acp_bbcodes'; $this->page_title = 'ACP_BBCODES'; @@ -41,11 +40,6 @@ class acp_bbcodes add_form_key($form_key); - if ($submit && !check_form_key($form_key)) - { - trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING); - } - // Set up mode-specific vars switch ($action) { @@ -179,6 +173,12 @@ class acp_bbcodes extract($phpbb_dispatcher->trigger_event('core.acp_bbcodes_modify_create', compact($vars))); $warn_text = preg_match('%<[^>]*\{text[\d]*\}[^>]*>%i', $bbcode_tpl); + + if (!$warn_text && !check_form_key($form_key)) + { + trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING); + } + if (!$warn_text || confirm_box(true)) { $data = $this->build_regexp($bbcode_match, $bbcode_tpl); |