Fixes CSRF token for pages with multiple forms

Octopussy-Project · Nov 13, 2016 · 512cab1 · 512cab1
1 parent fb9a799
commit 512cab1
Showing 1 changed file with 13 additions and 4 deletions.
diff --git a/usr/share/aat/INC/AAT_Form_Begin.inc b/usr/share/aat/INC/AAT_Form_Begin.inc
@@ -3,11 +3,20 @@
 <% 
 if ((!defined $arg{method}) || ($arg{method} eq "") || ($arg{method} =~ /^POST$/i))
 {
-	use Data::GUID;
+	my $token = undef;
 
-	my $guid = Data::GUID->new;
-	my $token = $guid->as_string;
-	$Session->{CSRFtoken} = $token;	
+	if (defined $Session->{CSRFtoken})
+	{	# not the first form on the page
+		$token = $Session->{CSRFtoken};
+	}
+	else
+	{
+		use Data::GUID;
+
+		my $guid = Data::GUID->new;
+		$token = $guid->as_string;
+		$Session->{CSRFtoken} = $token;	
+	}
 %>
 	<AAT:Form_Hidden name="CSRFtoken" value="$token" />
 <%