AS1024/Kanboard-Prod
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add missing CSRF check in saveUploadDB() method

Browse Source
This commit is contained in:
Frédéric Guillot
2018-01-29 11:31:54 -08:00
parent 573754c450
commit 357316cdf9
2 changed files with 2 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
app/Controller/ConfigController.php
View File

@@ -199,6 +199,7 @@ class ConfigController extends BaseController
*/ */
public function saveUploadedDb() public function saveUploadedDb()
{ {
$this->checkCSRFParam();
$filename = $this->request->getFilePath('file'); $filename = $this->request->getFilePath('file');
if (!file_exists($filename) || !$this->configModel->uploadDatabase($filename)) { if (!file_exists($filename) || !$this->configModel->uploadDatabase($filename)) {

4
app/Template/config/upload_db.php
View File

@@ -8,9 +8,7 @@
</p> </p>
</div> </div>
<form action="<?= $this->url->href('ConfigController', 'saveUploadedDb') ?>" method="post" enctype="multipart/form-data"> <form action="<?= $this->url->href('ConfigController', 'saveUploadedDb', [], true) ?>" method="post" enctype="multipart/form-data">
<?= $this->form->csrf() ?>
<?= $this->form->label(t('Database file'), 'file') ?> <?= $this->form->label(t('Database file'), 'file') ?>
<?= $this->form->file('file') ?> <?= $this->form->file('file') ?>