diff options
| author | Thomas Tanghus <thomas@tanghus.net> | 2013-02-04 12:02:16 -0800 |
|---|---|---|
| committer | Thomas Tanghus <thomas@tanghus.net> | 2013-02-04 12:02:16 -0800 |
| commit | 68fe6d0077ec97c28c3b320678aa46235ac5a4a6 (patch) | |
| tree | ffec0131e8873892b5342d68a9ca5f22c18d2282 | |
| parent | 951afcf3277bfe63ade14f6eff8577743af025d8 (diff) | |
| parent | bce59c39458c859d14978f255cf520f111ea78dd (diff) | |
| download | nextcloud-server-68fe6d0077ec97c28c3b320678aa46235ac5a4a6.tar.gz nextcloud-server-68fe6d0077ec97c28c3b320678aa46235ac5a4a6.zip | |
Merge pull request #1432 from owncloud/add_requesttoken
[user_webdavauth] add requesttoken
| -rwxr-xr-x | apps/user_webdavauth/settings.php | 4 | ||||
| -rwxr-xr-x | apps/user_webdavauth/templates/settings.php | 1 |
2 files changed, 4 insertions, 1 deletions
diff --git a/apps/user_webdavauth/settings.php b/apps/user_webdavauth/settings.php index 41d7fa51cd2..7eabb0d48cc 100755 --- a/apps/user_webdavauth/settings.php +++ b/apps/user_webdavauth/settings.php @@ -24,7 +24,9 @@ OC_Util::checkAdminUser(); if($_POST) { - + // CSRF check + OCP\JSON::callCheck(); + if(isset($_POST['webdav_url'])) { OC_CONFIG::setValue('user_webdavauth_url', strip_tags($_POST['webdav_url'])); } diff --git a/apps/user_webdavauth/templates/settings.php b/apps/user_webdavauth/templates/settings.php index 880b77ac959..45f4d81aecf 100755 --- a/apps/user_webdavauth/templates/settings.php +++ b/apps/user_webdavauth/templates/settings.php @@ -2,6 +2,7 @@ <fieldset class="personalblock"> <legend><strong><?php echo $l->t('WebDAV Authentication');?></strong></legend> <p><label for="webdav_url"><?php echo $l->t('URL: http://');?><input type="text" id="webdav_url" name="webdav_url" value="<?php echo $_['webdav_url']; ?>"></label> + <input type="hidden" name="requesttoken" value="<?php echo $_['requesttoken'] ?>" id="requesttoken"> <input type="submit" value="Save" /> <br /><?php echo $l->t('ownCloud will send the user credentials to this URL. This plugin checks the response and will interpret the HTTP statuscodes 401 and 403 as invalid credentials, and all other responses as valid credentials.'); ?> </fieldset> |