s3 swat: Add XSRF protection to status page

Signed-off-by: Kai Blin <kai@samba.org>

diff --git a/source3/web/statuspage.c b/source3/web/statuspage.c
index 02f5ca78e94db58cc3dd0e77d417b4544a19ea11..5314f3343269f5d7bdd4a2f384cf9345245f68dd 100644 (file)
--- a/source3/web/statuspage.c
+++ b/source3/web/statuspage.c
@@ -249,9 +249,14 @@ void status_page(void)
        int nr_running=0;
        bool waitup = False;
        TALLOC_CTX *ctx = talloc_stackframe();
+       const char form_name[] = "status";
 
        smbd_pid = pid_to_procid(pidfile_pid("smbd"));
 
+       if (!verify_xsrf_token(form_name)) {
+               goto output_page;
+       }
+
        if (cgi_variable("smbd_restart") || cgi_variable("all_restart")) {
                stop_smbd();
                start_smbd();
@@ -328,9 +333,11 @@ void status_page(void)
 
        initPid2Machine ();
 
+output_page:
        printf("<H2>%s</H2>\n", _("Server Status"));
 
        printf("<FORM method=post>\n");
+       print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
 
        if (!autorefresh) {
                printf("<input type=submit value=\"%s\" name=\"autorefresh\">\n", _("Auto Refresh"));