Many hyperlinks are disabled.
Use anonymous login
to enable hyperlinks.
Overview
| Comment: | Strengthen CSRF requirements for the skin editor. |
|---|---|
| Downloads: | Tarball | ZIP archive |
| Timelines: | family | ancestors | descendants | both | csrf-defense-enhancement |
| Files: | files | file ages | folders |
| SHA3-256: |
6912636dc3d22cadf8b9912783e8c033 |
| User & Date: | drh 2023-09-18 14:32:00.470 |
Context
|
2023-09-18
| ||
| 15:10 | More intensive use of the Synchronizer Token Pattern for CSRF defense. check-in: 0a66be2b75 user: drh tags: csrf-defense-enhancement | |
| 14:32 | Strengthen CSRF requirements for the skin editor. check-in: 6912636dc3 user: drh tags: csrf-defense-enhancement | |
| 14:29 | Cleanup forms on the skin editor page. check-in: 5feae3fd75 user: drh tags: csrf-defense-enhancement | |
Changes
Changes to src/skins.c.
| ︙ | ︙ | |||
838 839 840 841 842 843 844 |
zFile = aSkinAttr[ii].zFile;
zDraft = mprintf("draft%d", iSkin);
zTitle = mprintf("%s for Draft%d", aSkinAttr[ii].zTitle, iSkin);
zBasis = PD("basis","current");
zDflt = skin_file_content(zBasis, zFile);
zOrig = db_get_mprintf(zDflt, "draft%d-%s",iSkin,zFile);
zContent = PD(zFile,zOrig);
| | | > > | 838 839 840 841 842 843 844 845 846 847 848 849 850 851 852 853 854 855 856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 |
zFile = aSkinAttr[ii].zFile;
zDraft = mprintf("draft%d", iSkin);
zTitle = mprintf("%s for Draft%d", aSkinAttr[ii].zTitle, iSkin);
zBasis = PD("basis","current");
zDflt = skin_file_content(zBasis, zFile);
zOrig = db_get_mprintf(zDflt, "draft%d-%s",iSkin,zFile);
zContent = PD(zFile,zOrig);
if( P("revert")!=0 && cgi_csrf_safe(2) ){
zContent = zDflt;
isRevert = 1;
}
db_begin_transaction();
style_set_current_feature("skins");
style_header("%s", zTitle);
for(j=0; j<count(aSkinAttr); j++){
style_submenu_element(aSkinAttr[j].zSubmenu,
"%R/setup_skinedit?w=%d&basis=%h&sk=%d",j,zBasis,iSkin);
}
@ <form action="%R/setup_skinedit" method="post"><div>
login_insert_csrf_secret();
@ <input type='hidden' name='w' value='%d(ii)'>
@ <input type='hidden' name='sk' value='%d(iSkin)'>
@ <h2>Edit %s(zTitle):</h2>
if( P("submit") && cgi_csrf_safe(2)
&& (zOrig==0 || strcmp(zOrig,zContent)!=0)
){
db_set_mprintf(zContent, 0, "draft%d-%s",iSkin,zFile);
}
@ <textarea name="%s(zFile)" rows="10" cols="80">\
@ %h(zContent)</textarea>
@ <br>
@ <input type="submit" name="submit" value="Apply Changes">
if( isRevert ){
|
| ︙ | ︙ |