Fossil

Differences From Artifact [c7da451cff]:

• File src/setupuser.c — part of check-in [88a402fe2a] at 2023-09-18 13:18:41 on branch csrf-defense-enhancement — Try to simplify and rationalize the defenses against cross-site request forgery attacks. A hodgepodge of techniques have been used in the past. This changes attempts to make everything work more alike and to centralize CSRF defenses for easier auditing. (user: drh size: 33416)

To Artifact [3b1136b8d5]:

• File src/setupuser.c — part of check-in [0a66be2b75] at 2023-09-18 15:10:48 on branch csrf-defense-enhancement — More intensive use of the Synchronizer Token Pattern for CSRF defense. (user: drh size: 33416) [more...]

340
341
342
343
344
345
346
347

348
349
350
351
352
353
354

340
341
342
343
344
345
346

347
348
349
350
351
352
353
354

-
+

  if( P("can") ){
    /* User pressed the cancel button */
    cgi_redirect(cgi_referer("setup_ulist"));
    return;
  }

  /* Check for requests to delete the user */
  if( P("delete") && cgi_csrf_safe(1) ){
  if( P("delete") && cgi_csrf_safe(2) ){
    int n;
    if( P("verifydelete") ){
      /* Verified delete user request */
      db_unprotect(PROTECT_USER);
      if( alert_tables_exist() ){
        /* Also delete any subscriptions associated with this user */
        db_multi_exec("DELETE FROM subscriber WHERE suname="