From dac2c14ae932187f30b045bf700680d75375b9fa Mon Sep 17 00:00:00 2001 From: Thomas Tanghus Date: Thu, 5 Jul 2012 00:37:08 +0200 Subject: [PATCH] Add missing CSRF check. --- apps/contacts/ajax/uploadimport.php | 1 + apps/contacts/js/contacts.js | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/apps/contacts/ajax/uploadimport.php b/apps/contacts/ajax/uploadimport.php index c1e9c8b1ad1..9511520828f 100644 --- a/apps/contacts/ajax/uploadimport.php +++ b/apps/contacts/ajax/uploadimport.php @@ -23,6 +23,7 @@ // Check if we are a user OCP\JSON::checkLoggedIn(); OCP\JSON::checkAppEnabled('contacts'); +OCP\JSON::callCheck(); require_once('loghandler.php'); $view = OCP\Files::getStorage('contacts'); diff --git a/apps/contacts/js/contacts.js b/apps/contacts/js/contacts.js index d4b3ef588ba..25fc122bf30 100644 --- a/apps/contacts/js/contacts.js +++ b/apps/contacts/js/contacts.js @@ -1465,7 +1465,7 @@ Contacts={ } } }; - xhr.open('POST', OC.filePath('contacts', 'ajax', 'uploadimport.php') + '?file='+encodeURIComponent(file.name), true); + xhr.open('POST', OC.filePath('contacts', 'ajax', 'uploadimport.php') + '?file='+encodeURIComponent(file.name)+'&requesttoken='+requesttoken, true); xhr.setRequestHeader('Cache-Control', 'no-cache'); xhr.setRequestHeader('X-Requested-With', 'XMLHttpRequest'); xhr.setRequestHeader('X_FILE_NAME', encodeURIComponent(file.name)); -- 2.39.5