From: Kai Blin <kai@samba.org>
Date: Fri, 8 Jul 2011 13:04:12 +0000 (+0200)
Subject: s3 swat: Add XSRF protection to globals page
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=43bb2d4e9f162f2aaa4ae56dba27170fe1b8e9ae;p=thirdparty%2Fsamba.git

s3 swat: Add XSRF protection to globals page

Signed-off-by: Kai Blin <kai@samba.org>
(cherry picked from commit 8fb3064eeaa3640af6c8b91aa5859d8bfb6d0888)
---

diff --git a/source/web/swat.c b/source/web/swat.c
index b6e0c0f9d8a..5d11685db18 100644
--- a/source/web/swat.c
+++ b/source/web/swat.c
@@ -920,9 +920,14 @@ static void globals_page(void)
 {
 	unsigned int parm_filter = FLAG_BASIC;
 	int mode = 0;
+	const char form_name[] = "globals";
 
 	printf("<H2>%s</H2>\n", _("Global Parameters"));
 
+	if (!verify_xsrf_token(form_name)) {
+		goto output_page;
+	}
+
 	if (cgi_variable("Commit")) {
 		commit_parameters(GLOBAL_SECTION_SNUM);
 		save_reload(0);
@@ -935,7 +940,9 @@ static void globals_page(void)
 	if ( cgi_variable("AdvMode"))
 		mode = 1;
 
+output_page:
 	printf("<form name=\"swatform\" method=post action=globals>\n");
+	print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
 
 	ViewModeBoxes( mode );
 	switch ( mode ) {