sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-26 21:57:41 +03:00
Code

s3 swat: Add XSRF protection to printer page

Browse Source 
Signed-off-by: Kai Blin <kai@samba.org>
This commit is contained in:
Kai Blin 2011-07-08 15:06:13 +02:00 committed by Jeremy Allison
parent 072c199180
commit b5d63c3c11
1 changed files with 18 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
source3/web/swat.c
View File

@ -1345,18 +1345,15 @@ static void printers_page(void)
int i;
int mode = 0;
unsigned int parm_filter = FLAG_BASIC;
const char form_name[] = "printers";
if (!verify_xsrf_token(form_name)) {
goto output_page;
}
if (share)
snum = lp_servicenumber(share);
printf("<H2>%s</H2>\n", _("Printer Parameters"));
printf("<H3>%s</H3>\n", _("Important Note:"));
printf("%s",_("Printer names marked with [*] in the Choose Printer drop-down box "));
printf("%s",_("are autoloaded printers from "));
printf("<A HREF=\"/swat/help/smb.conf.5.html#printcapname\" target=\"docs\">%s</A>\n", _("Printcap Name"));
printf("%s\n", _("Attempting to delete these printers from SWAT will have no effect."));
if (cgi_variable("Commit") && snum >= 0) {
commit_parameters(snum);
if (snum >= iNumNonAutoPrintServices)
@ -1385,8 +1382,6 @@ static void printers_page(void)
}
}
printf("<FORM name=\"swatform\" method=post>\n");
if ( cgi_variable("ViewMode") )
mode = atoi(cgi_variable_nonull("ViewMode"));
if ( cgi_variable("BasicMode"))
@ -1394,6 +1389,19 @@ static void printers_page(void)
if ( cgi_variable("AdvMode"))
mode = 1;
output_page:
printf("<H2>%s</H2>\n", _("Printer Parameters"));
printf("<H3>%s</H3>\n", _("Important Note:"));
printf("%s",_("Printer names marked with [*] in the Choose Printer drop-down box "));
printf("%s",_("are autoloaded printers from "));
printf("<A HREF=\"/swat/help/smb.conf.5.html#printcapname\" target=\"docs\">%s</A>\n", _("Printcap Name"));
printf("%s\n", _("Attempting to delete these printers from SWAT will have no effect."));
printf("<FORM name=\"swatform\" method=post>\n");
print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
ViewModeBoxes( mode );
switch ( mode ) {
case 0: