Fossil

Check-in [4c444c1c]
Login

Check-in [4c444c1c]

Many hyperlinks are disabled.
Use anonymous login to enable hyperlinks.

Overview
Comment:Strengthen defenses against CSRF attacks.
Downloads: Tarball | ZIP archive | SQL archive
Timelines: family | ancestors | descendants | both | trunk
Files: files | file ages | folders
SHA3-256: 4c444c1c88689296595e5d38d4885fbcac185f165da3501554d385a8a727c875
User & Date: drh 2020-04-14 11:36:37
Context
2020-04-14
13:32
Add the /phantoms webpage that lists public phantom artifacts. Check the number of public phantom artifacts and puts a warning if the number is non-zero on the Security Audit page. ... (check-in: 83db2443 user: drh tags: trunk)
11:36
Strengthen defenses against CSRF attacks. ... (check-in: 4c444c1c user: drh tags: trunk)
10:59
Update to the Hints For Git Users document, based on anonymous suggestions from the forum. ... (check-in: 1f95ef53 user: drh tags: trunk)
Changes
Hide Diffs Unified Diffs Ignore Whitespace Patch

Changes to src/forum.c.

︙︙
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962

  const char *zMimetype = PD("mimetype",DEFAULT_FORUM_MIMETYPE);
  const char *zContent = PDT("content","");
  login_check_credentials();
  if( !g.perm.WrForum ){
    login_needed(g.anon.WrForum);
    return;
  }
  if( P("submit") ){
    if( forum_post(zTitle, 0, 0, 0, zMimetype, zContent) ) return;
  }
  if( P("preview") ){
    @ <h1>Preview:</h1>
    forum_render(zTitle, zMimetype, zContent, "forumEdit", 1);
  }
  style_header("New Forum Thread");








|








948
949
950
951
952
953
954
955
956
957
958
959
960
961
962

  const char *zMimetype = PD("mimetype",DEFAULT_FORUM_MIMETYPE);
  const char *zContent = PDT("content","");
  login_check_credentials();
  if( !g.perm.WrForum ){
    login_needed(g.anon.WrForum);
    return;
  }
  if( P("submit") && cgi_csrf_safe(1) ){
    if( forum_post(zTitle, 0, 0, 0, zMimetype, zContent) ) return;
  }
  if( P("preview") ){
    @ <h1>Preview:</h1>
    forum_render(zTitle, zMimetype, zContent, "forumEdit", 1);
  }
  style_header("New Forum Thread");
︙︙