AS1024/Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Avoid CSRF in users CSV import

Browse Source
This commit is contained in:
Frédéric Guillot
2019-01-31 20:06:49 -08:00
parent 928f80d569
commit 061ba4abe1
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
app/Controller/UserImportController.php
View File

@@ -3,6 +3,7 @@
namespace Kanboard\Controller; namespace Kanboard\Controller;
use Kanboard\Core\Csv; use Kanboard\Core\Csv;
use Kanboard\Core\Controller\AccessForbiddenException;
/** /**
* User Import controller * User Import controller
@@ -35,6 +36,12 @@ class UserImportController extends BaseController
public function save() public function save()
{ {
$values = $this->request->getValues(); $values = $this->request->getValues();
// Note: $values is empty when the CSRF token is invalid.
if (empty($values)) {
throw new AccessForbiddenException();
}
$filename = $this->request->getFilePath('file'); $filename = $this->request->getFilePath('file');
if (! file_exists($filename)) { if (! file_exists($filename)) {