fanbinit/rhymix
1
0
Fork 0
mirror of https://github.com/Lastorder-DC/rhymix.git synced 2026-01-09 03:32:00 +09:00
Code Issues Projects Releases Packages Wiki Activity

Fix CSRF check for GET requests

Browse source
This commit is contained in:
Kijin Sung 2017-04-23 14:51:41 +09:00
parent fa5c7afce2
commit 2822191271
2 changed files with 21 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

10
common/framework/security.php
View file

@ -307,11 +307,7 @@ class Security
*/
public static function checkCSRF($referer = null)
{
if ($_SERVER['REQUEST_METHOD'] === 'GET')
{
return true;
}
elseif ($token = $_SERVER['HTTP_X_CSRF_TOKEN'])
if ($token = $_SERVER['HTTP_X_CSRF_TOKEN'])
{
return Session::verifyToken($token);
}
@ -319,6 +315,10 @@ class Security
{
return Session::verifyToken($token);
}
elseif ($_SERVER['REQUEST_METHOD'] === 'GET')
{
return false;
}
else
{
if (Session::getMemberSrl())