From 93579d88dcea389205c01ddf6da41f37ad9b8745 Mon Sep 17 00:00:00 2001
From: Lukas Reschke <lukas@statuscode.ch>
Date: Fri, 20 Jul 2012 20:39:20 +0200
Subject: [PATCH] CSRF checks
---
settings/ajax/changepassword.php | 1 +
settings/ajax/creategroup.php | 1 +
settings/ajax/createuser.php | 1 +
settings/ajax/disableapp.php | 1 +
settings/ajax/enableapp.php | 1 +
settings/ajax/lostpassword.php | 4 +++-
settings/ajax/removegroup.php | 1 +
settings/ajax/removeuser.php | 1 +
settings/ajax/setlanguage.php | 2 +-
settings/ajax/setloglevel.php | 1 +
settings/ajax/setquota.php | 1 +
settings/ajax/togglegroups.php | 1 +
12 files changed, 14 insertions(+), 2 deletions(-)
diff --git a/settings/ajax/changepassword.php b/settings/ajax/changepassword.php
index 860ea98787..388885b6fc 100644
--- a/settings/ajax/changepassword.php
+++ b/settings/ajax/changepassword.php
@@ -2,6 +2,7 @@
// Init owncloud
require_once('../../lib/base.php');
+OCP\JSON::callCheck();
$username = isset($_POST["username"]) ? $_POST["username"] : OC_User::getUser();
$password = $_POST["password"];
diff --git a/settings/ajax/creategroup.php b/settings/ajax/creategroup.php
index 57d82e7bd9..a7fab1c45b 100644
--- a/settings/ajax/creategroup.php
+++ b/settings/ajax/creategroup.php
@@ -2,6 +2,7 @@
// Init owncloud
require_once('../../lib/base.php');
+OCP\JSON::callCheck();
// Check if we are a user
if( !OC_User::isLoggedIn() || !OC_Group::inGroup( OC_User::getUser(), 'admin' )){
diff --git a/settings/ajax/createuser.php b/settings/ajax/createuser.php
index 6714711bc8..508b4bf94c 100644
--- a/settings/ajax/createuser.php
+++ b/settings/ajax/createuser.php
@@ -2,6 +2,7 @@
// Init owncloud
require_once('../../lib/base.php');
+OCP\JSON::callCheck();
// Check if we are a user
if( !OC_User::isLoggedIn() || !OC_Group::inGroup( OC_User::getUser(), 'admin' )){
diff --git a/settings/ajax/disableapp.php b/settings/ajax/disableapp.php
index 53e9be379e..cc00698870 100644
--- a/settings/ajax/disableapp.php
+++ b/settings/ajax/disableapp.php
@@ -2,6 +2,7 @@
// Init owncloud
require_once('../../lib/base.php');
OC_JSON::checkAdminUser();
+OCP\JSON::callCheck();
OC_JSON::setContentTypeHeader();
OC_App::disable($_POST['appid']);
diff --git a/settings/ajax/enableapp.php b/settings/ajax/enableapp.php
index cb116ebe4e..bd53a50210 100644
--- a/settings/ajax/enableapp.php
+++ b/settings/ajax/enableapp.php
@@ -3,6 +3,7 @@
// Init owncloud
require_once('../../lib/base.php');
OC_JSON::checkAdminUser();
+OCP\JSON::callCheck();
OC_JSON::setContentTypeHeader();
if(OC_App::enable($_POST['appid'])){
diff --git a/settings/ajax/lostpassword.php b/settings/ajax/lostpassword.php
index 9c31c9ce8d..976fdff245 100644
--- a/settings/ajax/lostpassword.php
+++ b/settings/ajax/lostpassword.php
@@ -4,11 +4,13 @@
require_once('../../lib/base.php');
OC_JSON::checkLoggedIn();
+OCP\JSON::callCheck();
$l=OC_L10N::get('core');
// Get data
-if( isset( $_POST['email'] ) && filter_var( $_POST['email'], FILTER_VALIDATE_EMAIL) ){
$email=trim($_POST['email']);
+if( isset( $_POST['email'] ) && filter_var( $_POST['email'], FILTER_VALIDATE_EMAIL) ){
+ $email=trim($_POST['email']);
OC_Preferences::setValue(OC_User::getUser(),'settings','email',$email);
OC_JSON::success(array("data" => array( "message" => $l->t("Email saved") )));
}else{
diff --git a/settings/ajax/removegroup.php b/settings/ajax/removegroup.php
index 4d36478189..19cbe51fd5 100644
--- a/settings/ajax/removegroup.php
+++ b/settings/ajax/removegroup.php
@@ -4,6 +4,7 @@
require_once('../../lib/base.php');
OC_JSON::checkAdminUser();
+OCP\JSON::callCheck();
$name = $_POST["groupname"];
diff --git a/settings/ajax/removeuser.php b/settings/ajax/removeuser.php
index 2c288997a1..63388b3ca6 100644
--- a/settings/ajax/removeuser.php
+++ b/settings/ajax/removeuser.php
@@ -4,6 +4,7 @@
require_once('../../lib/base.php');
OC_JSON::checkAdminUser();
+OCP\JSON::callCheck();
$username = $_POST["username"];
diff --git a/settings/ajax/setlanguage.php b/settings/ajax/setlanguage.php
index e3b00c3bc8..bc70d09ac9 100644
--- a/settings/ajax/setlanguage.php
+++ b/settings/ajax/setlanguage.php
@@ -6,7 +6,7 @@ require_once('../../lib/base.php');
$l=OC_L10N::get('settings');
OC_JSON::checkLoggedIn();
-
+OCP\JSON::callCheck();
// Get data
if( isset( $_POST['lang'] ) ){
diff --git a/settings/ajax/setloglevel.php b/settings/ajax/setloglevel.php
index 298cbd6473..4b97ba2aa3 100644
--- a/settings/ajax/setloglevel.php
+++ b/settings/ajax/setloglevel.php
@@ -7,6 +7,7 @@
require_once('../../lib/base.php');
OC_Util::checkAdminUser();
+OCP\JSON::callCheck();
OC_Config::setValue( 'loglevel', $_POST['level'] );
diff --git a/settings/ajax/setquota.php b/settings/ajax/setquota.php
index f59017600a..44c2067824 100644
--- a/settings/ajax/setquota.php
+++ b/settings/ajax/setquota.php
@@ -9,6 +9,7 @@
require_once('../../lib/base.php');
OC_JSON::checkAdminUser();
+OCP\JSON::callCheck();
$username = isset($_POST["username"])?$_POST["username"]:'';
diff --git a/settings/ajax/togglegroups.php b/settings/ajax/togglegroups.php
index f76e22f51d..02b2b6319a 100644
--- a/settings/ajax/togglegroups.php
+++ b/settings/ajax/togglegroups.php
@@ -4,6 +4,7 @@
require_once('../../lib/base.php');
OC_JSON::checkAdminUser();
+OCP\JSON::callCheck();
$success = true;
$error = "add user to";
--
GitLab