maketank/Froxlor
2
0
Fork 0
Code Pull Requests Releases Activity

add csrf token header to jquery requests

Browse Source
This commit is contained in:
Maurice Preuß (envoyr)
2022-12-25 22:14:39 +01:00
parent ddc95762eb
commit 6ad78a4818
4 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
lib/init.php
View File

@@ -317,7 +317,7 @@ if (CurrentUser::hasSession()) {
$new_token = Froxlor::genSessionId(20);
UI::twig()->addGlobal('csrf_token', $new_token);
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$current_token = $_POST['csrf_token'];
$current_token = $_POST['csrf_token'] ?? $_SERVER['HTTP_X_CSRF_TOKEN'] ?? null;
if ($current_token != CurrentUser::getField('csrf_token')) {
Response::dynamicError('CSRF validation failed');
}