urosm
/
ikiwiki
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

checksessionexpiry: rework 

This function as factored out was a bit confusing, I think this makes more
sense.
master
Joey Hess 2008-12-17 14:26:08 -05:00
parent fdd994fb73
commit 985b229be6
3 changed files with 10 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
IkiWiki/CGI.pm
View File

@ -36,7 +36,7 @@ sub showform ($$$$;@) { #{{{
printheader($session); printheader($session);
print misctemplate($form->title, $form->render(submit => $buttons), @_); print misctemplate($form->title, $form->render(submit => $buttons), @_);
} } #}}}
sub redirect ($$) { #{{{ sub redirect ($$) { #{{{
my $q=shift; my $q=shift;
@ -273,7 +273,7 @@ sub check_banned ($$) { #{{{
exit; exit;
} }
} }
} } #}}}
sub cgi_getsession ($) { #{{{ sub cgi_getsession ($) { #{{{
my $q=shift; my $q=shift;
@ -296,14 +296,16 @@ sub cgi_getsession ($) { #{{{
return $session; return $session;
} #}}} } #}}}
# The session id is stored on the form and checked to # To guard against CSRF, the user's session id (sid)
# guard against CSRF. But only if the user is logged in, # can be stored on a form. This function will check
# as anonok can allow anonymous edits. # (for logged in users) that the sid on the form matches
# the session id in the cookie.
sub checksessionexpiry ($$) { # {{{ sub checksessionexpiry ($$) { # {{{
my $q=shift;
my $session = shift; my $session = shift;
my $sid = shift;
if (defined $session->param("name")) { if (defined $session->param("name")) {
my $sid=$q->param('sid');
if (! defined $sid || $sid ne $session->id) { if (! defined $sid || $sid ne $session->id) {
error(gettext("Your login session has expired.")); error(gettext("Your login session has expired."));
} }

2
IkiWiki/Plugin/comments.pm
View File

@ -468,7 +468,7 @@ sub sessioncgi ($$) { #{{{
if ($form->submitted eq POST_COMMENT && $form->validate) { if ($form->submitted eq POST_COMMENT && $form->validate) {
my $file = "$location._comment"; my $file = "$location._comment";
IkiWiki::checksessionexpiry($session, $cgi->param('sid')); IkiWiki::checksessionexpiry($cgi, $session);
# FIXME: could probably do some sort of graceful retry # FIXME: could probably do some sort of graceful retry
# on error? Would require significant unwinding though # on error? Would require significant unwinding though

2
IkiWiki/Plugin/editpage.pm
View File

@ -340,7 +340,7 @@ sub cgi_editpage ($$) { #{{{
else { else {
# save page # save page
check_canedit($page, $q, $session); check_canedit($page, $q, $session);
checksessionexpiry($session, $q->param('sid')); checksessionexpiry($q, $session, $q->param('sid'));
my $exists=-e "$config{srcdir}/$file"; my $exists=-e "$config{srcdir}/$file";