diff options
| author | Kai Blin <kai@samba.org> | 2011-07-08 15:03:44 +0200 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2011-07-26 22:22:25 +0200 |
| commit | 99fa6b386aad3a78ea54f1f083d40754c9ef6703 (patch) | |
| tree | 42ca3452aab8cb2f0df05bd007a057557efd1d98 /source3/web | |
| parent | ab98edd79dd98c989812ea9eab0418cfcb6bfc86 (diff) | |
| download | samba-99fa6b386aad3a78ea54f1f083d40754c9ef6703.tar.gz | |
s3 swat: Add XSRF protection to wizard page
Signed-off-by: Kai Blin <kai@samba.org>
Diffstat (limited to 'source3/web')
| -rw-r--r-- | source3/web/swat.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/source3/web/swat.c b/source3/web/swat.c index cdbbcb479b4..ac182dd7076 100644 --- a/source3/web/swat.c +++ b/source3/web/swat.c @@ -765,6 +765,11 @@ static void wizard_page(void) int have_home = -1; int HomeExpo = 0; int SerType = 0; + const char form_name[] = "wizard"; + + if (!verify_xsrf_token(form_name)) { + goto output_page; + } if (cgi_variable("Rewrite")) { (void) rewritecfg_file(); @@ -856,9 +861,11 @@ static void wizard_page(void) role = lp_server_role(); +output_page: /* Here we go ... */ printf("<H2>%s</H2>\n", _("Samba Configuration Wizard")); printf("<form method=post action=wizard>\n"); + print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name); if (have_write_access) { printf("%s\n", _("The \"Rewrite smb.conf file\" button will clear the smb.conf file of all default values and of comments.")); |