From d559763427efbbfef83e3a988b91ee8650247109 Mon Sep 17 00:00:00 2001
From: myvesta <38690722+myvesta@users.noreply.github.com>
Date: Sun, 15 Aug 2021 14:15:48 +0200
Subject: [PATCH] Preventing CSRF in edit/file

---
 web/edit/file/index.php | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/web/edit/file/index.php b/web/edit/file/index.php
index d6ae8dcee..9addd23e4 100644
--- a/web/edit/file/index.php
+++ b/web/edit/file/index.php
@@ -1,5 +1,14 @@
 <?php
 
+// Preventing CSRF
+$host_arr=explode(":", $_SERVER['HTTP_HOST']);
+$hostname=$host_arr[0];
+$port = $_SERVER['SERVER_PORT'];
+$expected_http_origin="https://".$hostname.":".$port;
+if ($_SERVER['HTTP_ORIGIN'] != $expected_http_origin) {
+    die ("Nope.");
+}
+
 include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 $user = $_SESSION['user'];