From 352477d825ab875b975495ff784c8addaaa6af21 Mon Sep 17 00:00:00 2001
From: Marius Cramer <m.cramer@pixcept.de>
Date: Thu, 21 May 2015 11:23:44 +0200
Subject: [PATCH] - fixed csrf protection
---
interface/lib/classes/tform_base.inc.php | 2 ++
interface/lib/lang/de.lng | 1 +
interface/lib/lang/en.lng | 1 +
3 files changed, 4 insertions(+)
diff --git a/interface/lib/classes/tform_base.inc.php b/interface/lib/classes/tform_base.inc.php
index d030c558cd..d61afd016e 100644
--- a/interface/lib/classes/tform_base.inc.php
+++ b/interface/lib/classes/tform_base.inc.php
@@ -709,6 +709,8 @@ class tform_base {
}
if($_csrf_valid !== true) {
$app->log('CSRF attempt blocked. Referer: ' . (isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : 'unknown'), LOGLEVEL_WARN);
+ $errmsg = 'err_csrf_attempt_blocked';
+ $this->errorMessage .= ($api == true ? $errmsg : $this->wordbook[$errmsg]."<br />") . "\r\n";
unset($_POST);
unset($record);
}
diff --git a/interface/lib/lang/de.lng b/interface/lib/lang/de.lng
index 735b1da09c..1fc1152558 100644
--- a/interface/lib/lang/de.lng
+++ b/interface/lib/lang/de.lng
@@ -41,6 +41,7 @@ $wb['top_menu_mailuser'] = 'E-Mail Benutzer';
$wb['top_menu_domain'] = 'Domains';
$wb['top_menu_dashboard'] = 'Ãœbersicht';
$wb['latest_news_txt'] = 'Neuigkeiten';
+$wb['err_csrf_attempt_blocked'] = 'CSRF-Versuch blockiert.';
$wb['top_menu_vm'] = 'vServer';
$wb['daynamesmin_su'] = 'So';
$wb['daynamesmin_mo'] = 'Mo';
diff --git a/interface/lib/lang/en.lng b/interface/lib/lang/en.lng
index 3c2bfafe20..d686739007 100644
--- a/interface/lib/lang/en.lng
+++ b/interface/lib/lang/en.lng
@@ -131,6 +131,7 @@ $wb['datalog_status_d_web_folder'] = 'Delete folder protection';
$wb['datalog_status_i_web_folder_user'] = 'Create folder protection user';
$wb['datalog_status_u_web_folder_user'] = 'Update folder protection user';
$wb['datalog_status_d_web_folder_user'] = 'Delete folder protection user';
+$wb['err_csrf_attempt_blocked'] = 'CSRF attempt blocked.';
$wb['login_as_txt'] = 'Log in as';
$wb["no_domain_perm"] = 'You have no permission for this domain.';
$wb["no_destination_perm"] = 'You have no permission for this destination.';
--
GitLab