From: Kai Blin <kai@samba.org>
Date: Fri, 8 Jul 2011 13:04:48 +0000 (+0200)
Subject: s3 swat: Add XSRF protection to shares page
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=68c94f82a5f0be5e7efe0bc12a3d7fd8b8174cd8;p=thirdparty%2Fsamba.git

s3 swat: Add XSRF protection to shares page

Signed-off-by: Kai Blin <kai@samba.org>
(cherry picked from commit 9839935c29ec0ab522994436e6e89939696409de)
---

diff --git a/source3/web/swat.c b/source3/web/swat.c
index 2c99f57829f..ecb279178b4 100644
--- a/source3/web/swat.c
+++ b/source3/web/swat.c
@@ -983,11 +983,17 @@ static void shares_page(void)
 	int mode = 0;
 	unsigned int parm_filter = FLAG_BASIC;
 	size_t converted_size;
+	const char form_name[] = "shares";
+
+	printf("<H2>%s</H2>\n", _("Share Parameters"));
+
+	if (!verify_xsrf_token(form_name)) {
+		goto output_page;
+	}
 
 	if (share)
 		snum = lp_servicenumber(share);
 
-	printf("<H2>%s</H2>\n", _("Share Parameters"));
 
 	if (cgi_variable("Commit") && snum >= 0) {
 		commit_parameters(snum);
@@ -1013,10 +1019,6 @@ static void shares_page(void)
 		}
 	}
 
-	printf("<FORM name=\"swatform\" method=post>\n");
-
-	printf("<table>\n");
-
 	if ( cgi_variable("ViewMode") )
 		mode = atoi(cgi_variable_nonull("ViewMode"));
 	if ( cgi_variable("BasicMode"))
@@ -1024,6 +1026,12 @@ static void shares_page(void)
 	if ( cgi_variable("AdvMode"))
 		mode = 1;
 
+output_page:
+	printf("<FORM name=\"swatform\" method=post>\n");
+	print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
+
+	printf("<table>\n");
+
 	ViewModeBoxes( mode );
 	switch ( mode ) {
 		case 0: