From e3de9d7dd1331f9718e04cc98e9ca7cfa27cf4aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nicolas=20L=C3=A9cureuil?= <neoclust@mageia.org>
Date: Sun, 17 May 2020 14:46:00 +0200
Subject: Sync with master of moonmoon ( version 9.0.0-rc) Source from
 https://github.com/Emmafrs/moonmoon/

---
 common/admin/changepassword.php | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

(limited to 'common/admin/changepassword.php')

diff --git a/common/admin/changepassword.php b/common/admin/changepassword.php
index 1fa505e..3b4500e 100644
--- a/common/admin/changepassword.php
+++ b/common/admin/changepassword.php
@@ -1,9 +1,11 @@
 <?php
-require_once dirname(__FILE__).'/inc/auth.inc.php';
 
-if (isset($_POST['password']) && ('' != $_POST['password'])){
+require_once __DIR__.'/../app/app.php';
+require_once __DIR__.'/inc/auth.inc.php';
+
+if ($csrf->verify($_POST['_csrf'], 'frmPassword') && isset($_POST['password']) && ('' != $_POST['password'])) {
     $out = '<?php $login="admin"; $password="'.md5($_POST['password']).'"; ?>';
-    file_put_contents(dirname(__FILE__).'/inc/pwd.inc.php', $out);
+    file_put_contents(__DIR__.'/inc/pwd.inc.php', $out);
     die("Password changed. <a href='administration.php'>Login</a>");
 } else {
     die('Can not change password');
-- 
cgit v1.2.1