From: Kai Blin <kai@samba.org>
Date: Fri, 8 Jul 2011 13:02:53 +0000 (+0200)
Subject: s3 swat: Add XSRF protection to viewconfig page
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6af465aa66ac9930fdf6676bdb0e5e1c7914f1fc;p=thirdparty%2Fsamba.git

s3 swat: Add XSRF protection to viewconfig page

Signed-off-by: Kai Blin <kai@samba.org>
(cherry picked from commit ba996f0ae87f6bf4f19a4918e44dbd6d44a96561)
---

diff --git a/source/web/swat.c b/source/web/swat.c
index e7d84e573df..647126fc280 100644
--- a/source/web/swat.c
+++ b/source/web/swat.c
@@ -664,13 +664,20 @@ static void welcome_page(void)
 static void viewconfig_page(void)
 {
 	int full_view=0;
+	const char form_name[] = "viewconfig";
+
+	if (!verify_xsrf_token(form_name)) {
+		goto output_page;
+	}
 
 	if (cgi_variable("full_view")) {
 		full_view = 1;
 	}
 
+output_page:
 	printf("<H2>%s</H2>\n", _("Current Config"));
 	printf("<form method=post>\n");
+	print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
 
 	if (full_view) {
 		printf("<input type=submit name=\"normal_view\" value=\"%s\">\n", _("Normal View"));