From: Kai Blin <kai@samba.org>
Date: Fri, 8 Jul 2011 13:03:15 +0000 (+0200)
Subject: s3 swat: Add XSRF protection to wizard_params page
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b8b08f7083a469a75ac21be52d637f453e652825;p=thirdparty%2Fsamba.git

s3 swat: Add XSRF protection to wizard_params page

Signed-off-by: Kai Blin <kai@samba.org>
(cherry picked from commit 4b64b7e57d729df996d0734444415f12c066b89f)
---

diff --git a/source3/web/swat.c b/source3/web/swat.c
index c0917db171c..45a830f4059 100644
--- a/source3/web/swat.c
+++ b/source3/web/swat.c
@@ -698,18 +698,25 @@ output_page:
 static void wizard_params_page(void)
 {
 	unsigned int parm_filter = FLAG_WIZARD;
+	const char form_name[] = "wizard_params";
 
 	/* Here we first set and commit all the parameters that were selected
  	   in the previous screen. */
 
 	printf("<H2>%s</H2>\n", _("Wizard Parameter Edit Page"));
 
+	if (!verify_xsrf_token(form_name)) {
+		goto output_page;
+	}
+
 	if (cgi_variable("Commit")) {
 		commit_parameters(GLOBAL_SECTION_SNUM);
 		save_reload(0);
 	}
 
+output_page:
 	printf("<form name=\"swatform\" method=post action=wizard_params>\n");
+	print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
 
 	if (have_write_access) {
 		printf("<input type=submit name=\"Commit\" value=\"Commit Changes\">\n");