urosm
/
ikiwiki
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

checksessionexpiry: rework 

This function as factored out was a bit confusing, I think this makes more
sense.
master
Joey Hess 2008-12-17 14:26:08 -05:00
parent fdd994fb73
commit 985b229be6
3 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
IkiWiki/CGI.pm
View File

@ -36,7 +36,7 @@ sub showform ($$$$;@) { #{{{
printheader($session);
print misctemplate($form->title, $form->render(submit => $buttons), @_);
}
} #}}}
sub redirect ($$) { #{{{
my $q=shift;
@ -273,7 +273,7 @@ sub check_banned ($$) { #{{{
exit;
}
}
}
} #}}}
sub cgi_getsession ($) { #{{{
my $q=shift;
@ -296,14 +296,16 @@ sub cgi_getsession ($) { #{{{
return $session;
} #}}}
# The session id is stored on the form and checked to
# guard against CSRF. But only if the user is logged in,
# as anonok can allow anonymous edits.
# To guard against CSRF, the user's session id (sid)
# can be stored on a form. This function will check
# (for logged in users) that the sid on the form matches
# the session id in the cookie.
sub checksessionexpiry ($$) { # {{{
my $q=shift;
my $session = shift;
my $sid = shift;
if (defined $session->param("name")) {
my $sid=$q->param('sid');
if (! defined $sid || $sid ne $session->id) {
error(gettext("Your login session has expired."));
}

2
IkiWiki/Plugin/comments.pm
View File

@ -468,7 +468,7 @@ sub sessioncgi ($$) { #{{{
if ($form->submitted eq POST_COMMENT && $form->validate) {
my $file = "$location._comment";
IkiWiki::checksessionexpiry($session, $cgi->param('sid'));
IkiWiki::checksessionexpiry($cgi, $session);
# FIXME: could probably do some sort of graceful retry
# on error? Would require significant unwinding though

2
IkiWiki/Plugin/editpage.pm
View File

@ -340,7 +340,7 @@ sub cgi_editpage ($$) { #{{{
else {
# save page
check_canedit($page, $q, $session);
checksessionexpiry($session, $q->param('sid'));
checksessionexpiry($q, $session, $q->param('sid'));
my $exists=-e "$config{srcdir}/$file";