diff options
| author |   Marc Alexander <admin@m-a-styles.de> | 2019-12-26 14:59:14 +0100 |
|---|---|---|
| committer | Marc Alexander <admin@m-a-styles.de> | 2019-12-26 14:59:14 +0100 |
| commit | c44c398626e933a89c1b897bd8a71f94a29336a6 (patch) | |
| tree | 5bdaa6188f9b39db6c39d1f5cb68bd2b79e2b67b | |
| parent | [prep-release-3.2.9] Add changelog for 3.2.9-RC1 (diff) | |
| download | phpbb-c44c398626e933a89c1b897bd8a71f94a29336a6.tar.gz phpbb-c44c398626e933a89c1b897bd8a71f94a29336a6.tar.bz2 phpbb-c44c398626e933a89c1b897bd8a71f94a29336a6.zip | |
[ticket/security-253] Check form key when exporting PM data
SECURITY-253
| -rw-r--r-- | phpBB/includes/ucp/ucp_pm_viewfolder.php | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/phpBB/includes/ucp/ucp_pm_viewfolder.php b/phpBB/includes/ucp/ucp_pm_viewfolder.php index 09e7bf4d7c..ce40a2507d 100644 --- a/phpBB/includes/ucp/ucp_pm_viewfolder.php +++ b/phpBB/includes/ucp/ucp_pm_viewfolder.php @@ -32,6 +32,8 @@ function view_folder($id, $mode, $folder_id, $folder) $folder_info = get_pm_from($folder_id, $folder, $user->data['user_id']); + add_form_key('ucp_pm_view_folder'); + if (!$submit_export) { $user->add_lang('viewforum'); @@ -197,6 +199,11 @@ function view_folder($id, $mode, $folder_id, $folder) $enclosure = $request->variable('enclosure', ''); $delimiter = $request->variable('delimiter', ''); + if (!check_form_key('ucp_pm_view_folder')) + { + trigger_error('FORM_INVALID'); + } + if ($export_type == 'CSV' && ($delimiter === '' || $enclosure === '')) { $template->assign_var('PROMPT', true); |