github/myvesta
1
0
Fork 0
mirror of https://github.com/myvesta/vesta synced 2025-08-20 13:24:25 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix for CSRF in FileManager and UploadHandler

Browse source
This commit is contained in:
myvesta 2021-09-04 15:31:34 +02:00
commit 93de22a0b3
6 changed files with 29 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

7
web/file_manager/fm_api.php
View file

@ -3,15 +3,18 @@
//error_reporting(NULL);
// Preventing CSRF
prevent_post_csrf(true);
// prevent_post_csrf(true);
header('Content-Type: application/json');
include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
include($_SERVER['DOCUMENT_ROOT']."/file_manager/fm_core.php");
// Check token
if ((!isset($_REQUEST['token'])) || ($_SESSION['token'] != $_REQUEST['token'])) {
die("Wrong token or missing token");
}
// todo: set in session?
if (empty($panel)) {
$command = VESTA_CMD."v-list-user '".$user."' 'json'";
exec ($command, $output, $return_var);