Fix bug: prevent CSRF attacks to admin page

git-svn-id: https://semanticscuttle.svn.sourceforge.net/svnroot/semanticscuttle/trunk@174 b3834d28-1941-0410-a4f8-b48e95affb8f

diff --git a/admin.php b/admin.php
index d72d4a08d7c642cd1b3c1c5cf249a52b14771c92..48adacb8d26b4308689f09cbfacf956c2ef1fc36 100644 (file)
--- a/admin.php
+++ b/admin.php
@@ -1,21 +1,21 @@
 <?php\r
 /***************************************************************************\r
-Copyright (C) 2007 - 2008 SemanticScuttle project (fork from Scuttle)\r
-http://sourceforge.net/projects/semanticscuttle/\r\r
+ Copyright (C) 2007 - 2008 SemanticScuttle project (fork from Scuttle)\r
+ http://sourceforge.net/projects/semanticscuttle/\r\r
 \r
-This program is free software; you can redistribute it and/or modify\r
-it under the terms of the GNU General Public License as published by\r
-the Free Software Foundation; either version 2 of the License, or\r
-(at your option) any later version.\r
+ This program is free software; you can redistribute it and/or modify\r
+ it under the terms of the GNU General Public License as published by\r
+ the Free Software Foundation; either version 2 of the License, or\r
+ (at your option) any later version.\r
 \r
-This program is distributed in the hope that it will be useful,\r
-but WITHOUT ANY WARRANTY; without even the implied warranty of\r
-MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\r
-GNU General Public License for more details.\r
-You should have received a copy of the GNU General Public License\r
-along with this program; if not, write to the Free Software\r
-Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA\r
-***************************************************************************/\r
+ This program is distributed in the hope that it will be useful,\r
+ but WITHOUT ANY WARRANTY; without even the implied warranty of\r
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\r
+ GNU General Public License for more details.\r
+ You should have received a copy of the GNU General Public License\r
+ along with this program; if not, write to the Free Software\r
+ Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA\r
+ ***************************************************************************/\r
 \r
 require_once('header.inc.php');\r
 
@@ -24,7 +24,10 @@ $userservice = & ServiceFactory :: getServiceInstance('UserService');
 $bookmark2tagservice = & ServiceFactory :: getServiceInstance('Bookmark2Tagservice');\r
 $bookmarkservice = & ServiceFactory :: getServiceInstance('BookmarkService');
 $tag2tagservice = & ServiceFactory :: getServiceInstance('Tag2TagService');\r
-$templateservice = & ServiceFactory :: getServiceInstance('TemplateService');\r
+$templateservice = & ServiceFactory :: getServiceInstance('TemplateService');
+
+/* Managing current logged user */
+$currentUser = $userservice->getCurrentObjectUser();\r
 \r
 // Header variables\r
 $tplVars['subtitle'] = T_('Manage users');\r
@@ -32,23 +35,21 @@ $tplVars['loadjs'] = true;
 $tplVars['sidebar_blocks'] = array('users' );\r
 \r
 if ( !$userservice->isLoggedOn() ) {\r
-    header('Location: '. createURL('login', ''));\r
-    exit();\r
-}\r
+       header('Location: '. createURL('login', ''));\r
+       exit();\r
+}
 \r
-//$currentUser = $userservice->getCurrentUser();\r
-//$currentUserID = $userservice->getCurrentUserId();\r
-//$currentUsername = $currentUser[$userservice->getFieldName('username')];\r
-$currentObjectUser = $userservice->getCurrentObjectUser();
-\r
-if ( !$currentObjectUser->isAdmin() ) {\r
-    header('Location: '. createURL('bookmarks', $currentObjectUser->getUsername()));\r
-    exit();\r
+if ( !$currentUser->isAdmin() ) {\r
+       header('Location: '. createURL('bookmarks', $currentUser->getUsername()));\r
+       exit();\r
 }\r
 \r
 @list($url, $action, $user) = isset($_SERVER['PATH_INFO']) ? explode('/', $_SERVER['PATH_INFO']) : NULL;\r
+
 \r
-if ( $action ) {\r
+if ( $action
+&& strpos($_SERVER['HTTP_REFERER'], ROOT.'/admin.php') == 0  // Prevent CSRF attacks
+) {\r
        switch ( $action ) {\r
                case 'delete':\r
                        if ( $user && ($userinfo = $userservice->getUserByUsername($user)) ) {\r
@@ -78,4 +79,4 @@ if ( !is_array($users) ) {
 $tplVars['users'] =& $users;\r
 \r
 $templateservice->loadTemplate($templatename, $tplVars);\r
-?>\r
+?>