Skip to content
Permalink
Browse files
check CSRF token enabling/disabling extensions. fixes #3559
  • Loading branch information
splitbrain committed Dec 8, 2021
1 parent b43eead commit 96f679fa1e16f81e322c6353d92ac8379e41fadd
Showing with 14 additions and 5 deletions.
  1. +6 −1 lib/plugins/extension/action.php
  2. +8 −4 lib/plugins/extension/script.js
@@ -57,8 +57,13 @@ public function info(Doku_Event $event, $param)
switch ($act) {
case 'enable':
case 'disable':
$extension->$act(); //enables/disables
if(getSecurityToken() != $INPUT->str('sectok')) {
http_status(403);
echo 'Security Token did not match. Possible CSRF attack.';
return;
}

$extension->$act(); //enables/disables
$reverse = ($act == 'disable') ? 'enable' : 'disable';

$return = array(
@@ -64,8 +64,9 @@ jQuery(function(){
DOKU_BASE + 'lib/exe/ajax.php',
{
call: 'plugin_extension',
ext: extension,
act: act
ext: extension,
act: act,
sectok: $btn.parents('form').find('input[name=sectok]').val()
},
function (data) {
$btn.css('cursor', '')
@@ -74,12 +75,15 @@ jQuery(function(){
.removeClass('enable')
.text(data.label)
.addClass(data.reverse)
.parents('li')
.parents('li')
.removeClass('disabled')
.removeClass('enabled')
.addClass(data.state);
}
);
).fail(function() {
$btn.css('cursor', '')
.removeAttr('disabled');
});
});

/**

0 comments on commit 96f679f

Please sign in to comment.