If tokens aren't present at all, refuse.

basho · Jul 12, 2012 · eaceaf5 · eaceaf5
1 parent 5b1e8b5
commit eaceaf5
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/riak_control_security.erl b/src/riak_control_security.erl
@@ -146,6 +146,8 @@ validate_csrf_token(RD, Ctx) ->
     BodyToken = proplists:get_value("csrf_token", Body),
     CookieToken = get_csrf_token(RD, Ctx),
     case BodyToken of
+        undefined ->
+            false;
         CookieToken ->
             true;
         _ ->