s3 swat: Add XSRF protection to shares page

Signed-off-by: Kai Blin <kai@samba.org>

diff --git a/source/web/swat.c b/source/web/swat.c
index 5d11685db186e3621c61b64af61cf9400b057a5d..4544c318e35ba6ebfcfea001d88d34230b3fde1f 100644 (file)
--- a/source/web/swat.c
+++ b/source/web/swat.c
@@ -982,11 +982,17 @@ static void shares_page(void)
        int mode = 0;
        unsigned int parm_filter = FLAG_BASIC;
        size_t converted_size;
+       const char form_name[] = "shares";
+
+       printf("<H2>%s</H2>\n", _("Share Parameters"));
+
+       if (!verify_xsrf_token(form_name)) {
+               goto output_page;
+       }
 
        if (share)
                snum = lp_servicenumber(share);
 
-       printf("<H2>%s</H2>\n", _("Share Parameters"));
 
        if (cgi_variable("Commit") && snum >= 0) {
                commit_parameters(snum);
@@ -1012,10 +1018,6 @@ static void shares_page(void)
                }
        }
 
-       printf("<FORM name=\"swatform\" method=post>\n");
-
-       printf("<table>\n");
-
        if ( cgi_variable("ViewMode") )
                mode = atoi(cgi_variable_nonull("ViewMode"));
        if ( cgi_variable("BasicMode"))
@@ -1023,6 +1025,12 @@ static void shares_page(void)
        if ( cgi_variable("AdvMode"))
                mode = 1;
 
+output_page:
+       printf("<FORM name=\"swatform\" method=post>\n");
+       print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
+
+       printf("<table>\n");
+
        ViewModeBoxes( mode );
        switch ( mode ) {
                case 0: