[Pkg-owncloud-commits] [owncloud] 28/394: Add CSRF check

[David Prévot]

This is an automated email from the git hooks/post-receive script.

taffit pushed a commit to annotated tag v4.5.10
in repository owncloud.

commit 3139636906842972fcddf6d57bf601a713f2e2d3
Author: Lukas Reschke <lukas at statuscode.ch>
Date:   Fri Nov 2 00:25:48 2012 +0100

    Add CSRF check
---
 apps/files/admin.php           |    2 +-
 apps/files/templates/admin.php |    1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/apps/files/admin.php b/apps/files/admin.php
index a8f2def..0f5b3d1 100644
--- a/apps/files/admin.php
+++ b/apps/files/admin.php
@@ -32,7 +32,7 @@ $htaccessWorking=(getenv('htaccessWorking')=='true');
 $upload_max_filesize = OCP\Util::computerFileSize(ini_get('upload_max_filesize'));
 $post_max_size = OCP\Util::computerFileSize(ini_get('post_max_size'));
 $maxUploadFilesize = OCP\Util::humanFileSize(min($upload_max_filesize, $post_max_size));
-if($_POST) {
+if($_POST && OC_Util::isCallRegistered()) {
 	if(isset($_POST['maxUploadSize'])) {
 		if(($setMaxSize = OC_Files::setUploadLimit(OCP\Util::computerFileSize($_POST['maxUploadSize']))) !== false) {
 			$maxUploadFilesize = OCP\Util::humanFileSize($setMaxSize);
diff --git a/apps/files/templates/admin.php b/apps/files/templates/admin.php
index c4fe4c8..5869ed2 100644
--- a/apps/files/templates/admin.php
+++ b/apps/files/templates/admin.php
@@ -11,6 +11,7 @@
 			<input name="maxZipInputSize" id="maxZipInputSize" style="width:180px;" value='<?php echo $_['maxZipInputSize'] ?>' title="<?php echo $l->t( '0 is unlimited' ); ?>"<?php if (!$_['allowZipDownload']) echo ' disabled="disabled"'; ?> />
 			<label for="maxZipInputSize"><?php echo $l->t( 'Maximum input size for ZIP files' ); ?> </label><br />
 
+		<input type="hidden" value="<?php echo $_['requesttoken']; ?>" name="requesttoken" />
 		<input type="submit" name="submitFilesAdminSettings" id="submitFilesAdminSettings" value="<?php echo $l->t( 'Save' ); ?>"/>
 	</fieldset>
 </form>

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/pkg-owncloud/owncloud.git