From: pdontthink Date: Fri, 18 Dec 2009 06:46:16 +0000 (+0000) Subject: Add security tokens to change password plugin X-Git-Url: https://vcs.fsf.org/?a=commitdiff_plain;h=ebba902dc0ab1001f798784ced76f43acd8c901a;p=squirrelmail.git Add security tokens to change password plugin git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@13878 7612ce4b-ef26-0410-bec9-ea0150e637f0 --- diff --git a/plugins/change_password/functions.php b/plugins/change_password/functions.php index f4de30cd..1e511274 100644 --- a/plugins/change_password/functions.php +++ b/plugins/change_password/functions.php @@ -105,7 +105,7 @@ function cpw_do_change() /* make sure we write the session data before we redirect */ session_write_close(); - header('Location: '.SM_PATH. 'src/options.php?optmode=submit&optpage=change_password&plugin_change_password=1'); + header('Location: '.SM_PATH. 'src/options.php?optmode=submit&optpage=change_password&plugin_change_password=1&smtoken=' . sm_generate_security_token()); exit; } diff --git a/plugins/change_password/options.php b/plugins/change_password/options.php index 2d504666..05941d04 100644 --- a/plugins/change_password/options.php +++ b/plugins/change_password/options.php @@ -53,6 +53,11 @@ if (file_exists(SM_PATH . 'plugins/change_password/backend/'.$cpw_backend.'.php' /* the form was submitted, go for it */ if(sqgetGlobalVar('cpw_go', $cpw_go, SQ_POST)) { + + // security check + sqgetGlobalVar('smtoken', $submitted_token, SQ_POST, ''); + sm_validate_security_token($submitted_token, 3600, TRUE); + /* perform basic checks */ $Messages = cpw_check_input(); @@ -83,6 +88,7 @@ if (isset($Messages) && count($Messages) > 0) { ?> +