From 93579d88dcea389205c01ddf6da41f37ad9b8745 Mon Sep 17 00:00:00 2001 From: Lukas Reschke Date: Fri, 20 Jul 2012 20:39:20 +0200 Subject: [PATCH] CSRF checks --- settings/ajax/changepassword.php | 1 + settings/ajax/creategroup.php | 1 + settings/ajax/createuser.php | 1 + settings/ajax/disableapp.php | 1 + settings/ajax/enableapp.php | 1 + settings/ajax/lostpassword.php | 4 +++- settings/ajax/removegroup.php | 1 + settings/ajax/removeuser.php | 1 + settings/ajax/setlanguage.php | 2 +- settings/ajax/setloglevel.php | 1 + settings/ajax/setquota.php | 1 + settings/ajax/togglegroups.php | 1 + 12 files changed, 14 insertions(+), 2 deletions(-) diff --git a/settings/ajax/changepassword.php b/settings/ajax/changepassword.php index 860ea987871..388885b6fcb 100644 --- a/settings/ajax/changepassword.php +++ b/settings/ajax/changepassword.php @@ -2,6 +2,7 @@ // Init owncloud require_once('../../lib/base.php'); +OCP\JSON::callCheck(); $username = isset($_POST["username"]) ? $_POST["username"] : OC_User::getUser(); $password = $_POST["password"]; diff --git a/settings/ajax/creategroup.php b/settings/ajax/creategroup.php index 57d82e7bd94..a7fab1c45be 100644 --- a/settings/ajax/creategroup.php +++ b/settings/ajax/creategroup.php @@ -2,6 +2,7 @@ // Init owncloud require_once('../../lib/base.php'); +OCP\JSON::callCheck(); // Check if we are a user if( !OC_User::isLoggedIn() || !OC_Group::inGroup( OC_User::getUser(), 'admin' )){ diff --git a/settings/ajax/createuser.php b/settings/ajax/createuser.php index 6714711bc87..508b4bf94ca 100644 --- a/settings/ajax/createuser.php +++ b/settings/ajax/createuser.php @@ -2,6 +2,7 @@ // Init owncloud require_once('../../lib/base.php'); +OCP\JSON::callCheck(); // Check if we are a user if( !OC_User::isLoggedIn() || !OC_Group::inGroup( OC_User::getUser(), 'admin' )){ diff --git a/settings/ajax/disableapp.php b/settings/ajax/disableapp.php index 53e9be379e1..cc006988707 100644 --- a/settings/ajax/disableapp.php +++ b/settings/ajax/disableapp.php @@ -2,6 +2,7 @@ // Init owncloud require_once('../../lib/base.php'); OC_JSON::checkAdminUser(); +OCP\JSON::callCheck(); OC_JSON::setContentTypeHeader(); OC_App::disable($_POST['appid']); diff --git a/settings/ajax/enableapp.php b/settings/ajax/enableapp.php index cb116ebe4e8..bd53a50210c 100644 --- a/settings/ajax/enableapp.php +++ b/settings/ajax/enableapp.php @@ -3,6 +3,7 @@ // Init owncloud require_once('../../lib/base.php'); OC_JSON::checkAdminUser(); +OCP\JSON::callCheck(); OC_JSON::setContentTypeHeader(); if(OC_App::enable($_POST['appid'])){ diff --git a/settings/ajax/lostpassword.php b/settings/ajax/lostpassword.php index 9c31c9ce8da..976fdff245f 100644 --- a/settings/ajax/lostpassword.php +++ b/settings/ajax/lostpassword.php @@ -4,11 +4,13 @@ require_once('../../lib/base.php'); OC_JSON::checkLoggedIn(); +OCP\JSON::callCheck(); $l=OC_L10N::get('core'); // Get data -if( isset( $_POST['email'] ) && filter_var( $_POST['email'], FILTER_VALIDATE_EMAIL) ){ $email=trim($_POST['email']); +if( isset( $_POST['email'] ) && filter_var( $_POST['email'], FILTER_VALIDATE_EMAIL) ){ + $email=trim($_POST['email']); OC_Preferences::setValue(OC_User::getUser(),'settings','email',$email); OC_JSON::success(array("data" => array( "message" => $l->t("Email saved") ))); }else{ diff --git a/settings/ajax/removegroup.php b/settings/ajax/removegroup.php index 4d364781894..19cbe51fd51 100644 --- a/settings/ajax/removegroup.php +++ b/settings/ajax/removegroup.php @@ -4,6 +4,7 @@ require_once('../../lib/base.php'); OC_JSON::checkAdminUser(); +OCP\JSON::callCheck(); $name = $_POST["groupname"]; diff --git a/settings/ajax/removeuser.php b/settings/ajax/removeuser.php index 2c288997a1f..63388b3ca68 100644 --- a/settings/ajax/removeuser.php +++ b/settings/ajax/removeuser.php @@ -4,6 +4,7 @@ require_once('../../lib/base.php'); OC_JSON::checkAdminUser(); +OCP\JSON::callCheck(); $username = $_POST["username"]; diff --git a/settings/ajax/setlanguage.php b/settings/ajax/setlanguage.php index e3b00c3bc80..bc70d09ac92 100644 --- a/settings/ajax/setlanguage.php +++ b/settings/ajax/setlanguage.php @@ -6,7 +6,7 @@ require_once('../../lib/base.php'); $l=OC_L10N::get('settings'); OC_JSON::checkLoggedIn(); - +OCP\JSON::callCheck(); // Get data if( isset( $_POST['lang'] ) ){ diff --git a/settings/ajax/setloglevel.php b/settings/ajax/setloglevel.php index 298cbd64738..4b97ba2aa32 100644 --- a/settings/ajax/setloglevel.php +++ b/settings/ajax/setloglevel.php @@ -7,6 +7,7 @@ require_once('../../lib/base.php'); OC_Util::checkAdminUser(); +OCP\JSON::callCheck(); OC_Config::setValue( 'loglevel', $_POST['level'] ); diff --git a/settings/ajax/setquota.php b/settings/ajax/setquota.php index f59017600ac..44c2067824b 100644 --- a/settings/ajax/setquota.php +++ b/settings/ajax/setquota.php @@ -9,6 +9,7 @@ require_once('../../lib/base.php'); OC_JSON::checkAdminUser(); +OCP\JSON::callCheck(); $username = isset($_POST["username"])?$_POST["username"]:''; diff --git a/settings/ajax/togglegroups.php b/settings/ajax/togglegroups.php index f76e22f51d2..02b2b6319a6 100644 --- a/settings/ajax/togglegroups.php +++ b/settings/ajax/togglegroups.php @@ -4,6 +4,7 @@ require_once('../../lib/base.php'); OC_JSON::checkAdminUser(); +OCP\JSON::callCheck(); $success = true; $error = "add user to"; -- 2.39.5