s3 swat: Add XSRF protection to globals page

Signed-off-by: Kai Blin <kai@samba.org>

diff --git a/source3/web/swat.c b/source3/web/swat.c
index 30bc2964d2f9345e69175d11a47d944988cb39dd..5dab7c78815fea128d2027dcf62539075c54b8a3 100644 (file)
--- a/source3/web/swat.c
+++ b/source3/web/swat.c
@@ -921,9 +921,14 @@ static void globals_page(void)
 {
        unsigned int parm_filter = FLAG_BASIC;
        int mode = 0;
+       const char form_name[] = "globals";
 
        printf("<H2>%s</H2>\n", _("Global Parameters"));
 
+       if (!verify_xsrf_token(form_name)) {
+               goto output_page;
+       }
+
        if (cgi_variable("Commit")) {
                commit_parameters(GLOBAL_SECTION_SNUM);
                save_reload(0);
@@ -936,7 +941,9 @@ static void globals_page(void)
        if ( cgi_variable("AdvMode"))
                mode = 1;
 
+output_page:
        printf("<form name=\"swatform\" method=post action=globals>\n");
+       print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
 
        ViewModeBoxes( mode );
        switch ( mode ) {