AS1024
/
Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add missing CSRF check in saveUploadDB() method

This commit is contained in:
Frédéric Guillot 2018-01-29 11:31:54 -08:00
parent 573754c450
commit 357316cdf9
2 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
app/Controller/ConfigController.php
View File

@ -199,6 +199,7 @@ class ConfigController extends BaseController
*/
public function saveUploadedDb()
{
$this->checkCSRFParam();
$filename = $this->request->getFilePath('file');
if (!file_exists($filename) || !$this->configModel->uploadDatabase($filename)) {

4
app/Template/config/upload_db.php
View File

@ -8,9 +8,7 @@
</p>
</div>
<form action="<?= $this->url->href('ConfigController', 'saveUploadedDb') ?>" method="post" enctype="multipart/form-data">
<?= $this->form->csrf() ?>
<form action="<?= $this->url->href('ConfigController', 'saveUploadedDb', [], true) ?>" method="post" enctype="multipart/form-data">
<?= $this->form->label(t('Database file'), 'file') ?>
<?= $this->form->file('file') ?>