Changeset 6897 for trunk/profile.php

Timestamp:

Sep 13, 2010, 9:40:42 PM (14 years ago)

Author:

nikrou

Message:

Fix bug 1856 : CSRF issue that allow to change admin password

File:

• trunk/profile.php (modified) (2 diffs)

trunk/profile.php

@@ -36 +36 @@
   // +-----------------------------------------------------------------------+
   check_status(ACCESS_CLASSIC);
+
+  if (!empty($_POST))
+  {
+    check_pwg_token();
+  }
 
   $userdata = $user;
@@ -290 +295 @@
   trigger_action( 'load_profile_in_template', $userdata );
 
+  $template->assign('PWG_TOKEN', get_pwg_token());
   $template->assign_var_from_handle('PROFILE_CONTENT', 'profile_content');
 }