Bommels05/Mozilla
Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 621105 - [SECURITY] Voting lacks CSRF protection

Browse Source 
r=mkanat,a=LpSolit


git-svn-id: svn://10.0.0.236/trunk@261814 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
mkanat%bugzilla.org 2011-01-24 19:53:26 +00:00
parent 3c1eb91b87
commit 192acb445e
4 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
mozilla/webtools/bugzilla/.bzrrev
View File

@ -1 +1 @@
7674
7675

4
mozilla/webtools/bugzilla/extensions/Voting/Extension.pm
View File

@ -36,6 +36,7 @@ use Bugzilla::Field;
use Bugzilla::Mailer;
use Bugzilla::User;
use Bugzilla::Util qw(detaint_natural);
use Bugzilla::Token;
use List::Util qw(min);
@ -529,6 +530,9 @@ sub _update_votes {
|| ThrowUserError("voting_must_be_nonnegative");
}
my $token = $cgi->param('token');
check_hash_token($token, ['vote']);
############################################################################
# End Data/Security Validation
############################################################################

1
mozilla/webtools/bugzilla/extensions/Voting/template/en/default/pages/voting/user.html.tmpl
View File

@ -74,6 +74,7 @@
[% IF products.size %]
<form name="voting_form" method="post" action="page.cgi?id=voting/user.html">
<input type="hidden" name="action" value="vote">
<input type="hidden" name="token" value="[% issue_hash_token(['vote']) FILTER html %]">
<table cellspacing="4">
<tr>
<td></td>

1
mozilla/webtools/bugzilla/extensions/Voting/template/en/default/voting/delete-all.html.tmpl
View File

@ -35,6 +35,7 @@
<form action="page.cgi?id=voting/user.html" method="post">
<input type="hidden" name="action" value="vote">
<input type="hidden" name="token" value="[% issue_hash_token(['vote']) FILTER html %]">
<p>
<input type="radio" name="delete_all_votes" value="1">
Yes, delete all my votes