xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-08-11 22:01:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #160 from NIKO28/patch-1

Browse Source 
Login CSFR Protection
This commit is contained in:
yi12345
2012-11-03 00:38:02 -07:00
parent 176c313845 3843f27349
commit a143a852ed
1 changed files with 9 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
login.php
+9
View File
@@ -20,6 +20,14 @@ if(isset($_GET['del_cookie'])) {
if(!isset($_COOKIE['COOKUSR'])) { if(!isset($_COOKIE['COOKUSR'])) {
$_COOKIE['COOKUSR'] = ""; $_COOKIE['COOKUSR'] = "";
} }
if ( $_SERVER[ 'REQUEST_METHOD' ] == 'POST' ) {
if ( !isset( $_SESSION[ 'csrf' ] ) || $_SESSION[ 'csrf' ] !== $_POST[ 'csrf' ] )
throw new RuntimeException( 'CSRF attack' );
}
$key = sha1( microtime() );
$_SESSION[ 'csrf' ] = $key;
?> ?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html> <html>
@@ -213,6 +221,7 @@ CountBack(gsecs);
?> ?>
<form method="post" name="snd" action="login.php"> <form method="post" name="snd" action="login.php">
<input type="hidden" name="ft" value="a4" /> <input type="hidden" name="ft" value="a4" />
<input type="hidden" name="csrf" value="<?php echo $key; ?>" />
<script type="text/javascript"> <script type="text/javascript">
Element.implement({ Element.implement({
//imgid: falls zu dem link ein pfeil geh?rt kann dieser "auf/zugeklappt" werden //imgid: falls zu dem link ein pfeil geh?rt kann dieser "auf/zugeklappt" werden