public/tt-rss
1
0
Fork 0
mirror of https://git.tt-rss.org/git/tt-rss.git synced 2025-12-16 08:25:57 +00:00
Code Issues Releases Wiki Activity

pluginhandler: reject method requests without CSRF

Browse Source
This commit is contained in:
Andrew Dolgov
2021-02-17 15:04:39 +03:00
parent 2b2833bb4f
commit 7be1e3ed38
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
classes/pluginhandler.php
View File

@@ -14,8 +14,8 @@ class PluginHandler extends Handler_Protected {
if (validate_csrf($csrf_token)) { if (validate_csrf($csrf_token)) {
$plugin->$method(); $plugin->$method();
} else { } else {
user_error("Requested ${plugin_name}->${method}() with invalid CSRF token.", E_USER_DEPRECATED); user_error("Rejected ${plugin_name}->${method}(): invalid CSRF token.", E_USER_WARNING);
$plugin->$method(); print error_json(6);
} }
} else { } else {
user_error("Rejected ${plugin_name}->${method}(): unknown method.", E_USER_WARNING); user_error("Rejected ${plugin_name}->${method}(): unknown method.", E_USER_WARNING);