From ebba902dc0ab1001f798784ced76f43acd8c901a Mon Sep 17 00:00:00 2001
From: pdontthink <pdontthink@7612ce4b-ef26-0410-bec9-ea0150e637f0>
Date: Fri, 18 Dec 2009 06:46:16 +0000
Subject: [PATCH] Add security tokens to change password plugin

git-svn-id: https://svn.code.sf.net/p/squirrelmail/code/trunk/squirrelmail@13878 7612ce4b-ef26-0410-bec9-ea0150e637f0
---
 plugins/change_password/functions.php | 2 +-
 plugins/change_password/options.php   | 6 ++++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/plugins/change_password/functions.php b/plugins/change_password/functions.php
index f4de30cd..1e511274 100644
--- a/plugins/change_password/functions.php
+++ b/plugins/change_password/functions.php
@@ -105,7 +105,7 @@ function cpw_do_change()
 
     /* make sure we write the session data before we redirect */
     session_write_close();
-    header('Location: '.SM_PATH. 'src/options.php?optmode=submit&optpage=change_password&plugin_change_password=1');
+    header('Location: '.SM_PATH. 'src/options.php?optmode=submit&optpage=change_password&plugin_change_password=1&smtoken=' . sm_generate_security_token());
     exit;
 }
 
diff --git a/plugins/change_password/options.php b/plugins/change_password/options.php
index 2d504666..05941d04 100644
--- a/plugins/change_password/options.php
+++ b/plugins/change_password/options.php
@@ -53,6 +53,11 @@ if (file_exists(SM_PATH . 'plugins/change_password/backend/'.$cpw_backend.'.php'
 
 /* the form was submitted, go for it */
 if(sqgetGlobalVar('cpw_go', $cpw_go, SQ_POST)) {
+
+    // security check
+    sqgetGlobalVar('smtoken', $submitted_token, SQ_POST, '');
+    sm_validate_security_token($submitted_token, 3600, TRUE);
+
     /* perform basic checks */
     $Messages = cpw_check_input();
 
@@ -83,6 +88,7 @@ if (isset($Messages) && count($Messages) > 0) {
 
 ?><tr><td>
     <?php echo addForm($_SERVER['PHP_SELF'], 'post'); ?>
+    <input type="hidden" name="smtoken" value="<?php echo sm_generate_security_token() ?>" />
     <table>
       <tr>
         <th align="right"><?php echo _("Current Password:")?></th>
-- 
2.25.1