0a66be2b754… — Fossil SCM

M src/alerts.c

+7 -6

		--- src/alerts.c
		+++ src/alerts.c
		@@ -1545,11 +1545,11 @@
1545	1545	}
1546	1546	style_set_current_feature("alerts");
1547	1547	alert_submenu_common();
1548	1548	needCaptcha = !login_is_individual();
1549	1549	if( P("submit")
1550		- && cgi_csrf_safe(1)
	1550	+ && cgi_csrf_safe(2)
1551	1551	&& subscribe_error_check(&eErr,&zErr,needCaptcha)
1552	1552	){
1553	1553	/* A validated request for a new subscription has been received. */
1554	1554	char ssub[20];
1555	1555	const char *zEAddr = P("e");
		@@ -1856,11 +1856,11 @@
1856	1856	db_commit_transaction();
1857	1857	cgi_redirect("subscribe");
1858	1858	/NOTREACHED/
1859	1859	}
1860	1860	alert_submenu_common();
1861		- if( P("submit")!=0 && cgi_csrf_safe(1) ){
	1861	+ if( P("submit")!=0 && cgi_csrf_safe(2) ){
1862	1862	char newSsub[10];
1863	1863	int nsub = 0;
1864	1864	Blob update;
1865	1865
1866	1866	sdonotcall = PB("sdonotcall");
		@@ -1918,11 +1918,11 @@
1918	1918	"UPDATE subscriber SET lastContact=now()/86400"
1919	1919	" WHERE subscriberId=%d", sid
1920	1920	);
1921	1921	db_protect_pop();
1922	1922	}
1923		- if( P("delete")!=0 && cgi_csrf_safe(1) ){
	1923	+ if( P("delete")!=0 && cgi_csrf_safe(2) ){
1924	1924	if( !PB("dodelete") ){
1925	1925	eErr = 9;
1926	1926	zErr = mprintf("Select this checkbox and press \"Unsubscribe\" again to"
1927	1927	" unsubscribe");
1928	1928	}else{
		@@ -2269,11 +2269,11 @@
2269	2269
2270	2270	style_set_current_feature("alerts");
2271	2271
2272	2272	zEAddr = PD("e","");
2273	2273	dx = atoi(PD("dx","0"));
2274		- bSubmit = P("submit")!=0 && P("e")!=0 && cgi_csrf_safe(1);
	2274	+ bSubmit = P("submit")!=0 && P("e")!=0 && cgi_csrf_safe(2);
2275	2275	if( bSubmit ){
2276	2276	if( !captcha_is_correct(1) ){
2277	2277	eErr = 2;
2278	2278	zErr = mprintf("enter the security code shown below");
2279	2279	bSubmit = 0;
		@@ -3300,11 +3300,11 @@
3300	3300	}
3301	3301	if( P("submit")!=0
3302	3302	&& P("subject")!=0
3303	3303	&& P("msg")!=0
3304	3304	&& P("from")!=0
3305		- && cgi_csrf_safe(1)
	3305	+ && cgi_csrf_safe(2)
3306	3306	&& captcha_is_correct(0)
3307	3307	){
3308	3308	Blob hdr, body;
3309	3309	AlertSender *pSender = alert_sender_new(0,0);
3310	3310	blob_init(&hdr, 0, 0);
		@@ -3477,11 +3477,11 @@
3477	3477	/* Visit the /announce/test1 page to see the CGI variables */
3478	3478	zAction = "announce/test1";
3479	3479	@ <p style='border: 1px solid black; padding: 1ex;'>
3480	3480	cgi_print_all(0, 0, 0);
3481	3481	@ </p>
3482		- }else if( P("submit")!=0 && cgi_csrf_safe(1) ){
	3482	+ }else if( P("submit")!=0 && cgi_csrf_safe(2) ){
3483	3483	char *zErr = alert_send_announcement();
3484	3484	style_header("Announcement Sent");
3485	3485	if( zErr ){
3486	3486	@ <h1>Internal Error</h1>
3487	3487	@ <p>The following error was reported by the system:
		@@ -3502,10 +3502,11 @@
3502	3502	return;
3503	3503	}
3504	3504
3505	3505	style_header("Send Announcement");
3506	3506	@ <form method="POST" action="%R/%s(zAction)">
	3507	+ login_insert_csrf_secret();
3507	3508	@ <table class="subscribe">
3508	3509	if( g.perm.Admin ){
3509	3510	int aa = PB("aa");
3510	3511	int all = PB("all");
3511	3512	int aMod = PB("mods");
3512	3513

	--- src/alerts.c
	+++ src/alerts.c
	@@ -1545,11 +1545,11 @@
1545	}
1546	style_set_current_feature("alerts");
1547	alert_submenu_common();
1548	needCaptcha = !login_is_individual();
1549	if( P("submit")
1550	&& cgi_csrf_safe(1)
1551	&& subscribe_error_check(&eErr,&zErr,needCaptcha)
1552	){
1553	/* A validated request for a new subscription has been received. */
1554	char ssub[20];
1555	const char *zEAddr = P("e");
	@@ -1856,11 +1856,11 @@
1856	db_commit_transaction();
1857	cgi_redirect("subscribe");
1858	/NOTREACHED/
1859	}
1860	alert_submenu_common();
1861	if( P("submit")!=0 && cgi_csrf_safe(1) ){
1862	char newSsub[10];
1863	int nsub = 0;
1864	Blob update;
1865
1866	sdonotcall = PB("sdonotcall");
	@@ -1918,11 +1918,11 @@
1918	"UPDATE subscriber SET lastContact=now()/86400"
1919	" WHERE subscriberId=%d", sid
1920	);
1921	db_protect_pop();
1922	}
1923	if( P("delete")!=0 && cgi_csrf_safe(1) ){
1924	if( !PB("dodelete") ){
1925	eErr = 9;
1926	zErr = mprintf("Select this checkbox and press \"Unsubscribe\" again to"
1927	" unsubscribe");
1928	}else{
	@@ -2269,11 +2269,11 @@
2269
2270	style_set_current_feature("alerts");
2271
2272	zEAddr = PD("e","");
2273	dx = atoi(PD("dx","0"));
2274	bSubmit = P("submit")!=0 && P("e")!=0 && cgi_csrf_safe(1);
2275	if( bSubmit ){
2276	if( !captcha_is_correct(1) ){
2277	eErr = 2;
2278	zErr = mprintf("enter the security code shown below");
2279	bSubmit = 0;
	@@ -3300,11 +3300,11 @@
3300	}
3301	if( P("submit")!=0
3302	&& P("subject")!=0
3303	&& P("msg")!=0
3304	&& P("from")!=0
3305	&& cgi_csrf_safe(1)
3306	&& captcha_is_correct(0)
3307	){
3308	Blob hdr, body;
3309	AlertSender *pSender = alert_sender_new(0,0);
3310	blob_init(&hdr, 0, 0);
	@@ -3477,11 +3477,11 @@
3477	/* Visit the /announce/test1 page to see the CGI variables */
3478	zAction = "announce/test1";
3479	@ <p style='border: 1px solid black; padding: 1ex;'>
3480	cgi_print_all(0, 0, 0);
3481	@ </p>
3482	}else if( P("submit")!=0 && cgi_csrf_safe(1) ){
3483	char *zErr = alert_send_announcement();
3484	style_header("Announcement Sent");
3485	if( zErr ){
3486	@ <h1>Internal Error</h1>
3487	@ <p>The following error was reported by the system:
	@@ -3502,10 +3502,11 @@
3502	return;
3503	}
3504
3505	style_header("Send Announcement");
3506	@ <form method="POST" action="%R/%s(zAction)">

3507	@ <table class="subscribe">
3508	if( g.perm.Admin ){
3509	int aa = PB("aa");
3510	int all = PB("all");
3511	int aMod = PB("mods");
3512

	--- src/alerts.c
	+++ src/alerts.c
	@@ -1545,11 +1545,11 @@
1545	}
1546	style_set_current_feature("alerts");
1547	alert_submenu_common();
1548	needCaptcha = !login_is_individual();
1549	if( P("submit")
1550	&& cgi_csrf_safe(2)
1551	&& subscribe_error_check(&eErr,&zErr,needCaptcha)
1552	){
1553	/* A validated request for a new subscription has been received. */
1554	char ssub[20];
1555	const char *zEAddr = P("e");
	@@ -1856,11 +1856,11 @@
1856	db_commit_transaction();
1857	cgi_redirect("subscribe");
1858	/NOTREACHED/
1859	}
1860	alert_submenu_common();
1861	if( P("submit")!=0 && cgi_csrf_safe(2) ){
1862	char newSsub[10];
1863	int nsub = 0;
1864	Blob update;
1865
1866	sdonotcall = PB("sdonotcall");
	@@ -1918,11 +1918,11 @@
1918	"UPDATE subscriber SET lastContact=now()/86400"
1919	" WHERE subscriberId=%d", sid
1920	);
1921	db_protect_pop();
1922	}
1923	if( P("delete")!=0 && cgi_csrf_safe(2) ){
1924	if( !PB("dodelete") ){
1925	eErr = 9;
1926	zErr = mprintf("Select this checkbox and press \"Unsubscribe\" again to"
1927	" unsubscribe");
1928	}else{
	@@ -2269,11 +2269,11 @@
2269
2270	style_set_current_feature("alerts");
2271
2272	zEAddr = PD("e","");
2273	dx = atoi(PD("dx","0"));
2274	bSubmit = P("submit")!=0 && P("e")!=0 && cgi_csrf_safe(2);
2275	if( bSubmit ){
2276	if( !captcha_is_correct(1) ){
2277	eErr = 2;
2278	zErr = mprintf("enter the security code shown below");
2279	bSubmit = 0;
	@@ -3300,11 +3300,11 @@
3300	}
3301	if( P("submit")!=0
3302	&& P("subject")!=0
3303	&& P("msg")!=0
3304	&& P("from")!=0
3305	&& cgi_csrf_safe(2)
3306	&& captcha_is_correct(0)
3307	){
3308	Blob hdr, body;
3309	AlertSender *pSender = alert_sender_new(0,0);
3310	blob_init(&hdr, 0, 0);
	@@ -3477,11 +3477,11 @@
3477	/* Visit the /announce/test1 page to see the CGI variables */
3478	zAction = "announce/test1";
3479	@ <p style='border: 1px solid black; padding: 1ex;'>
3480	cgi_print_all(0, 0, 0);
3481	@ </p>
3482	}else if( P("submit")!=0 && cgi_csrf_safe(2) ){
3483	char *zErr = alert_send_announcement();
3484	style_header("Announcement Sent");
3485	if( zErr ){
3486	@ <h1>Internal Error</h1>
3487	@ <p>The following error was reported by the system:
	@@ -3502,10 +3502,11 @@
3502	return;
3503	}
3504
3505	style_header("Send Announcement");
3506	@ <form method="POST" action="%R/%s(zAction)">
3507	login_insert_csrf_secret();
3508	@ <table class="subscribe">
3509	if( g.perm.Admin ){
3510	int aa = PB("aa");
3511	int all = PB("all");
3512	int aMod = PB("mods");
3513

M src/forum.c

+6 -2

		--- src/forum.c
		+++ src/forum.c
		@@ -1539,11 +1539,11 @@
1539	1539	login_check_credentials();
1540	1540	if( !g.perm.WrForum ){
1541	1541	login_needed(g.anon.WrForum);
1542	1542	return;
1543	1543	}
1544		- if( P("submit") && cgi_csrf_safe(1) ){
	1544	+ if( P("submit") && cgi_csrf_safe(2) ){
1545	1545	if( forum_post(zTitle, 0, 0, 0, zMimetype, zContent,
1546	1546	forum_post_flags()) ) return;
1547	1547	}
1548	1548	if( P("preview") && !whitespace_only(zContent) ){
1549	1549	@ <h1>Preview:</h1>
		@@ -1560,10 +1560,11 @@
1560	1560	@ <input type="submit" name="submit" value="Submit">
1561	1561	}else{
1562	1562	@ <input type="submit" name="submit" value="Submit" disabled>
1563	1563	}
1564	1564	forum_render_debug_options();
	1565	+ login_insert_csrf_secret();
1565	1566	@ </form>
1566	1567	forum_emit_js();
1567	1568	style_finish_page();
1568	1569	}
1569	1570
		@@ -1611,11 +1612,11 @@
1611	1612	return;
1612	1613	}
1613	1614	bPreview = P("preview")!=0;
1614	1615	bReply = P("reply")!=0;
1615	1616	iClosed = forum_rid_is_closed(fpid, 1);
1616		- isCsrfSafe = cgi_csrf_safe(1);
	1617	+ isCsrfSafe = cgi_csrf_safe(2);
1617	1618	bPrivate = content_is_private(fpid);
1618	1619	bSameUser = login_is_individual()
1619	1620	&& fossil_strcmp(pPost->zUser, g.zLogin)==0;
1620	1621	if( isCsrfSafe && (g.perm.ModForum \|\| (bPrivate && bSameUser)) ){
1621	1622	if( g.perm.ModForum && P("approve") ){
		@@ -1679,10 +1680,11 @@
1679	1680	forum_render(pPost->zThreadTitle, pPost->zMimetype, pPost->zWiki,
1680	1681	"forumEdit", 1);
1681	1682	@ <h1>Change Into:</h1>
1682	1683	forum_render(zTitle, zMimetype, zContent,"forumEdit", 1);
1683	1684	@ <form action="%R/forume2" method="POST">
	1685	+ login_insert_csrf_secret();
1684	1686	@ <input type="hidden" name="fpid" value="%h(P("fpid"))">
1685	1687	@ <input type="hidden" name="nullout" value="1">
1686	1688	@ <input type="hidden" name="mimetype" value="%h(zMimetype)">
1687	1689	@ <input type="hidden" name="content" value="%h(zContent)">
1688	1690	if( zTitle ){
		@@ -1706,10 +1708,11 @@
1706	1708	@ <h2>Preview of Edited Post:</h2>
1707	1709	forum_render(zTitle, zMimetype, zContent,"forumEdit", 1);
1708	1710	}
1709	1711	@ <h2>Revised Message:</h2>
1710	1712	@ <form action="%R/forume2" method="POST">
	1713	+ login_insert_csrf_secret();
1711	1714	@ <input type="hidden" name="fpid" value="%h(P("fpid"))">
1712	1715	@ <input type="hidden" name="edit" value="1">
1713	1716	forum_from_line();
1714	1717	forum_post_widget(zTitle, zMimetype, zContent);
1715	1718	}else{
		@@ -1750,10 +1753,11 @@
1750	1753	if( !iClosed \|\| g.perm.Admin ) {
1751	1754	@ <input type="submit" name="submit" value="Submit">
1752	1755	}
1753	1756	}
1754	1757	forum_render_debug_options();
	1758	+ login_insert_csrf_secret();
1755	1759	@ </form>
1756	1760	forum_emit_js();
1757	1761	style_finish_page();
1758	1762	}
1759	1763
1760	1764

	--- src/forum.c
	+++ src/forum.c
	@@ -1539,11 +1539,11 @@
1539	login_check_credentials();
1540	if( !g.perm.WrForum ){
1541	login_needed(g.anon.WrForum);
1542	return;
1543	}
1544	if( P("submit") && cgi_csrf_safe(1) ){
1545	if( forum_post(zTitle, 0, 0, 0, zMimetype, zContent,
1546	forum_post_flags()) ) return;
1547	}
1548	if( P("preview") && !whitespace_only(zContent) ){
1549	@ <h1>Preview:</h1>
	@@ -1560,10 +1560,11 @@
1560	@ <input type="submit" name="submit" value="Submit">
1561	}else{
1562	@ <input type="submit" name="submit" value="Submit" disabled>
1563	}
1564	forum_render_debug_options();

1565	@ </form>
1566	forum_emit_js();
1567	style_finish_page();
1568	}
1569
	@@ -1611,11 +1612,11 @@
1611	return;
1612	}
1613	bPreview = P("preview")!=0;
1614	bReply = P("reply")!=0;
1615	iClosed = forum_rid_is_closed(fpid, 1);
1616	isCsrfSafe = cgi_csrf_safe(1);
1617	bPrivate = content_is_private(fpid);
1618	bSameUser = login_is_individual()
1619	&& fossil_strcmp(pPost->zUser, g.zLogin)==0;
1620	if( isCsrfSafe && (g.perm.ModForum \|\| (bPrivate && bSameUser)) ){
1621	if( g.perm.ModForum && P("approve") ){
	@@ -1679,10 +1680,11 @@
1679	forum_render(pPost->zThreadTitle, pPost->zMimetype, pPost->zWiki,
1680	"forumEdit", 1);
1681	@ <h1>Change Into:</h1>
1682	forum_render(zTitle, zMimetype, zContent,"forumEdit", 1);
1683	@ <form action="%R/forume2" method="POST">

1684	@ <input type="hidden" name="fpid" value="%h(P("fpid"))">
1685	@ <input type="hidden" name="nullout" value="1">
1686	@ <input type="hidden" name="mimetype" value="%h(zMimetype)">
1687	@ <input type="hidden" name="content" value="%h(zContent)">
1688	if( zTitle ){
	@@ -1706,10 +1708,11 @@
1706	@ <h2>Preview of Edited Post:</h2>
1707	forum_render(zTitle, zMimetype, zContent,"forumEdit", 1);
1708	}
1709	@ <h2>Revised Message:</h2>
1710	@ <form action="%R/forume2" method="POST">

1711	@ <input type="hidden" name="fpid" value="%h(P("fpid"))">
1712	@ <input type="hidden" name="edit" value="1">
1713	forum_from_line();
1714	forum_post_widget(zTitle, zMimetype, zContent);
1715	}else{
	@@ -1750,10 +1753,11 @@
1750	if( !iClosed \|\| g.perm.Admin ) {
1751	@ <input type="submit" name="submit" value="Submit">
1752	}
1753	}
1754	forum_render_debug_options();

1755	@ </form>
1756	forum_emit_js();
1757	style_finish_page();
1758	}
1759
1760

	--- src/forum.c
	+++ src/forum.c
	@@ -1539,11 +1539,11 @@
1539	login_check_credentials();
1540	if( !g.perm.WrForum ){
1541	login_needed(g.anon.WrForum);
1542	return;
1543	}
1544	if( P("submit") && cgi_csrf_safe(2) ){
1545	if( forum_post(zTitle, 0, 0, 0, zMimetype, zContent,
1546	forum_post_flags()) ) return;
1547	}
1548	if( P("preview") && !whitespace_only(zContent) ){
1549	@ <h1>Preview:</h1>
	@@ -1560,10 +1560,11 @@
1560	@ <input type="submit" name="submit" value="Submit">
1561	}else{
1562	@ <input type="submit" name="submit" value="Submit" disabled>
1563	}
1564	forum_render_debug_options();
1565	login_insert_csrf_secret();
1566	@ </form>
1567	forum_emit_js();
1568	style_finish_page();
1569	}
1570
	@@ -1611,11 +1612,11 @@
1612	return;
1613	}
1614	bPreview = P("preview")!=0;
1615	bReply = P("reply")!=0;
1616	iClosed = forum_rid_is_closed(fpid, 1);
1617	isCsrfSafe = cgi_csrf_safe(2);
1618	bPrivate = content_is_private(fpid);
1619	bSameUser = login_is_individual()
1620	&& fossil_strcmp(pPost->zUser, g.zLogin)==0;
1621	if( isCsrfSafe && (g.perm.ModForum \|\| (bPrivate && bSameUser)) ){
1622	if( g.perm.ModForum && P("approve") ){
	@@ -1679,10 +1680,11 @@
1680	forum_render(pPost->zThreadTitle, pPost->zMimetype, pPost->zWiki,
1681	"forumEdit", 1);
1682	@ <h1>Change Into:</h1>
1683	forum_render(zTitle, zMimetype, zContent,"forumEdit", 1);
1684	@ <form action="%R/forume2" method="POST">
1685	login_insert_csrf_secret();
1686	@ <input type="hidden" name="fpid" value="%h(P("fpid"))">
1687	@ <input type="hidden" name="nullout" value="1">
1688	@ <input type="hidden" name="mimetype" value="%h(zMimetype)">
1689	@ <input type="hidden" name="content" value="%h(zContent)">
1690	if( zTitle ){
	@@ -1706,10 +1708,11 @@
1708	@ <h2>Preview of Edited Post:</h2>
1709	forum_render(zTitle, zMimetype, zContent,"forumEdit", 1);
1710	}
1711	@ <h2>Revised Message:</h2>
1712	@ <form action="%R/forume2" method="POST">
1713	login_insert_csrf_secret();
1714	@ <input type="hidden" name="fpid" value="%h(P("fpid"))">
1715	@ <input type="hidden" name="edit" value="1">
1716	forum_from_line();
1717	forum_post_widget(zTitle, zMimetype, zContent);
1718	}else{
	@@ -1750,10 +1753,11 @@
1753	if( !iClosed \|\| g.perm.Admin ) {
1754	@ <input type="submit" name="submit" value="Submit">
1755	}
1756	}
1757	forum_render_debug_options();
1758	login_insert_csrf_secret();
1759	@ </form>
1760	forum_emit_js();
1761	style_finish_page();
1762	}
1763
1764

M src/interwiki.c

+1 -1

		--- src/interwiki.c
		+++ src/interwiki.c
		@@ -314,11 +314,11 @@
314	314	login_check_credentials();
315	315	if( !g.perm.Read && !g.perm.RdWiki && ~g.perm.RdTkt ){
316	316	login_needed(0);
317	317	return;
318	318	}
319		- if( g.perm.Setup && P("submit")!=0 && cgi_csrf_safe(1) ){
	319	+ if( g.perm.Setup && P("submit")!=0 && cgi_csrf_safe(2) ){
320	320	zTag = PT("tag");
321	321	zBase = PT("base");
322	322	zHash = PT("hash");
323	323	zWiki = PT("wiki");
324	324	if( zTag==0 \|\| zTag[0]==0 \|\| !interwiki_valid_name(zTag) ){
325	325

	--- src/interwiki.c
	+++ src/interwiki.c
	@@ -314,11 +314,11 @@
314	login_check_credentials();
315	if( !g.perm.Read && !g.perm.RdWiki && ~g.perm.RdTkt ){
316	login_needed(0);
317	return;
318	}
319	if( g.perm.Setup && P("submit")!=0 && cgi_csrf_safe(1) ){
320	zTag = PT("tag");
321	zBase = PT("base");
322	zHash = PT("hash");
323	zWiki = PT("wiki");
324	if( zTag==0 \|\| zTag[0]==0 \|\| !interwiki_valid_name(zTag) ){
325

	--- src/interwiki.c
	+++ src/interwiki.c
	@@ -314,11 +314,11 @@
314	login_check_credentials();
315	if( !g.perm.Read && !g.perm.RdWiki && ~g.perm.RdTkt ){
316	login_needed(0);
317	return;
318	}
319	if( g.perm.Setup && P("submit")!=0 && cgi_csrf_safe(2) ){
320	zTag = PT("tag");
321	zBase = PT("base");
322	zHash = PT("hash");
323	zWiki = PT("wiki");
324	if( zTag==0 \|\| zTag[0]==0 \|\| !interwiki_valid_name(zTag) ){
325

M src/login.c

+2 -2

		--- src/login.c
		+++ src/login.c
		@@ -1982,11 +1982,11 @@
1982	1982	zConfirm = PDT("cp","");
1983	1983	zEAddr = PDT("ea","");
1984	1984	zDName = PDT("dn","");
1985	1985
1986	1986	/* Verify user imputs */
1987		- if( P("new")==0 \|\| !cgi_csrf_safe(1) ){
	1987	+ if( P("new")==0 \|\| !cgi_csrf_safe(2) ){
1988	1988	/* This is not a valid form submission. Fall through into
1989	1989	** the form display */
1990	1990	}else if( (captchaIsCorrect = captcha_is_correct(1))==0 ){
1991	1991	iErrLine = 6;
1992	1992	zErr = "Incorrect CAPTCHA";
		@@ -2260,11 +2260,11 @@
2260	2260	return;
2261	2261	}
2262	2262	zEAddr = PDT("ea","");
2263	2263
2264	2264	/* Verify user imputs */
2265		- if( !cgi_csrf_safe(1) \|\| P("reqpwreset")==0 ){
	2265	+ if( !cgi_csrf_safe(2) \|\| P("reqpwreset")==0 ){
2266	2266	/* This is the initial display of the form. No processing or error
2267	2267	** checking is to be done. Fall through into the form display
2268	2268	*/
2269	2269	}else if( (captchaIsCorrect = captcha_is_correct(1))==0 ){
2270	2270	iErrLine = 2;
2271	2271

	--- src/login.c
	+++ src/login.c
	@@ -1982,11 +1982,11 @@
1982	zConfirm = PDT("cp","");
1983	zEAddr = PDT("ea","");
1984	zDName = PDT("dn","");
1985
1986	/* Verify user imputs */
1987	if( P("new")==0 \|\| !cgi_csrf_safe(1) ){
1988	/* This is not a valid form submission. Fall through into
1989	** the form display */
1990	}else if( (captchaIsCorrect = captcha_is_correct(1))==0 ){
1991	iErrLine = 6;
1992	zErr = "Incorrect CAPTCHA";
	@@ -2260,11 +2260,11 @@
2260	return;
2261	}
2262	zEAddr = PDT("ea","");
2263
2264	/* Verify user imputs */
2265	if( !cgi_csrf_safe(1) \|\| P("reqpwreset")==0 ){
2266	/* This is the initial display of the form. No processing or error
2267	** checking is to be done. Fall through into the form display
2268	*/
2269	}else if( (captchaIsCorrect = captcha_is_correct(1))==0 ){
2270	iErrLine = 2;
2271

	--- src/login.c
	+++ src/login.c
	@@ -1982,11 +1982,11 @@
1982	zConfirm = PDT("cp","");
1983	zEAddr = PDT("ea","");
1984	zDName = PDT("dn","");
1985
1986	/* Verify user imputs */
1987	if( P("new")==0 \|\| !cgi_csrf_safe(2) ){
1988	/* This is not a valid form submission. Fall through into
1989	** the form display */
1990	}else if( (captchaIsCorrect = captcha_is_correct(1))==0 ){
1991	iErrLine = 6;
1992	zErr = "Incorrect CAPTCHA";
	@@ -2260,11 +2260,11 @@
2260	return;
2261	}
2262	zEAddr = PDT("ea","");
2263
2264	/* Verify user imputs */
2265	if( !cgi_csrf_safe(2) \|\| P("reqpwreset")==0 ){
2266	/* This is the initial display of the form. No processing or error
2267	** checking is to be done. Fall through into the form display
2268	*/
2269	}else if( (captchaIsCorrect = captcha_is_correct(1))==0 ){
2270	iErrLine = 2;
2271

M src/security_audit.c

+2 -1

		--- src/security_audit.c
		+++ src/security_audit.c
		@@ -795,11 +795,11 @@
795	795	@ command.
796	796	@ </ol>
797	797	style_finish_page();
798	798	return;
799	799	}
800		- if( P("truncate1") && cgi_csrf_safe(1) ){
	800	+ if( P("truncate1") && cgi_csrf_safe(2) ){
801	801	fclose(fopen(g.zErrlog,"w"));
802	802	}
803	803	if( P("download") ){
804	804	Blob log;
805	805	blob_read_from_file(&log, g.zErrlog, ExtFILE);
		@@ -808,10 +808,11 @@
808	808	return;
809	809	}
810	810	szFile = file_size(g.zErrlog, ExtFILE);
811	811	if( P("truncate") ){
812	812	@ <form action="%R/errorlog" method="POST">
	813	+ login_insert_csrf_secret();
813	814	@ <p>Confirm that you want to truncate the %,lld(szFile)-byte error log:
814	815	@ <input type="submit" name="truncate1" value="Confirm">
815	816	@ <input type="submit" name="cancel" value="Cancel">
816	817	@ </form>
817	818	style_finish_page();
818	819

	--- src/security_audit.c
	+++ src/security_audit.c
	@@ -795,11 +795,11 @@
795	@ command.
796	@ </ol>
797	style_finish_page();
798	return;
799	}
800	if( P("truncate1") && cgi_csrf_safe(1) ){
801	fclose(fopen(g.zErrlog,"w"));
802	}
803	if( P("download") ){
804	Blob log;
805	blob_read_from_file(&log, g.zErrlog, ExtFILE);
	@@ -808,10 +808,11 @@
808	return;
809	}
810	szFile = file_size(g.zErrlog, ExtFILE);
811	if( P("truncate") ){
812	@ <form action="%R/errorlog" method="POST">

813	@ <p>Confirm that you want to truncate the %,lld(szFile)-byte error log:
814	@ <input type="submit" name="truncate1" value="Confirm">
815	@ <input type="submit" name="cancel" value="Cancel">
816	@ </form>
817	style_finish_page();
818

	--- src/security_audit.c
	+++ src/security_audit.c
	@@ -795,11 +795,11 @@
795	@ command.
796	@ </ol>
797	style_finish_page();
798	return;
799	}
800	if( P("truncate1") && cgi_csrf_safe(2) ){
801	fclose(fopen(g.zErrlog,"w"));
802	}
803	if( P("download") ){
804	Blob log;
805	blob_read_from_file(&log, g.zErrlog, ExtFILE);
	@@ -808,10 +808,11 @@
808	return;
809	}
810	szFile = file_size(g.zErrlog, ExtFILE);
811	if( P("truncate") ){
812	@ <form action="%R/errorlog" method="POST">
813	login_insert_csrf_secret();
814	@ <p>Confirm that you want to truncate the %,lld(szFile)-byte error log:
815	@ <input type="submit" name="truncate1" value="Confirm">
816	@ <input type="submit" name="cancel" value="Cancel">
817	@ </form>
818	style_finish_page();
819

M src/setup.c

+4 -4

		--- src/setup.c
		+++ src/setup.c
		@@ -1454,11 +1454,11 @@
1454	1454	if( !g.perm.Admin ){
1455	1455	login_needed(0);
1456	1456	return;
1457	1457	}
1458	1458	db_begin_transaction();
1459		- if( P("clear")!=0 && cgi_csrf_safe(1) ){
	1459	+ if( P("clear")!=0 && cgi_csrf_safe(2) ){
1460	1460	db_unprotect(PROTECT_CONFIG);
1461	1461	db_multi_exec("DELETE FROM config WHERE name GLOB 'adunit*'");
1462	1462	db_protect_pop();
1463	1463	cgi_replace_parameter("adunit","");
1464	1464	cgi_replace_parameter("adright","");
		@@ -1556,11 +1556,11 @@
1556	1556	if( !g.perm.Admin ){
1557	1557	login_needed(0);
1558	1558	return;
1559	1559	}
1560	1560	db_begin_transaction();
1561		- if( !cgi_csrf_safe(1) ){
	1561	+ if( !cgi_csrf_safe(2) ){
1562	1562	/* Allow no state changes if not safe from CSRF */
1563	1563	}else if( P("setlogo")!=0 && zLogoMime && zLogoMime[0] && szLogoImg>0 ){
1564	1564	Blob img;
1565	1565	Stmt ins;
1566	1566	blob_init(&img, aLogoImg, szLogoImg);
		@@ -1765,11 +1765,11 @@
1765	1765	if( !g.perm.Setup ){
1766	1766	login_needed(0);
1767	1767	return;
1768	1768	}
1769	1769	add_content_sql_commands(g.db);
1770		- zQ = cgi_csrf_safe(1) ? P("q") : 0;
	1770	+ zQ = cgi_csrf_safe(2) ? P("q") : 0;
1771	1771	style_set_current_feature("setup");
1772	1772	style_header("Raw SQL Commands");
1773	1773	@ <p><b>Caution:</b> There are no restrictions on the SQL that can be
1774	1774	@ run by this page. You can do serious and irrepairable damage to the
1775	1775	@ repository. Proceed with extreme caution.</p>
		@@ -2122,11 +2122,11 @@
2122	2122	Blob *pSql,
2123	2123	const char *zOldName,
2124	2124	const char *zNewName,
2125	2125	const char *zValue
2126	2126	){
2127		- if( !cgi_csrf_safe(1) ) return;
	2127	+ if( !cgi_csrf_safe(2) ) return;
2128	2128	if( zNewName[0]==0 \|\| zValue[0]==0 ){
2129	2129	if( zOldName[0] ){
2130	2130	blob_append_sql(pSql,
2131	2131	"DELETE FROM config WHERE name='walias:%q';\n",
2132	2132	zOldName);
2133	2133

	--- src/setup.c
	+++ src/setup.c
	@@ -1454,11 +1454,11 @@
1454	if( !g.perm.Admin ){
1455	login_needed(0);
1456	return;
1457	}
1458	db_begin_transaction();
1459	if( P("clear")!=0 && cgi_csrf_safe(1) ){
1460	db_unprotect(PROTECT_CONFIG);
1461	db_multi_exec("DELETE FROM config WHERE name GLOB 'adunit*'");
1462	db_protect_pop();
1463	cgi_replace_parameter("adunit","");
1464	cgi_replace_parameter("adright","");
	@@ -1556,11 +1556,11 @@
1556	if( !g.perm.Admin ){
1557	login_needed(0);
1558	return;
1559	}
1560	db_begin_transaction();
1561	if( !cgi_csrf_safe(1) ){
1562	/* Allow no state changes if not safe from CSRF */
1563	}else if( P("setlogo")!=0 && zLogoMime && zLogoMime[0] && szLogoImg>0 ){
1564	Blob img;
1565	Stmt ins;
1566	blob_init(&img, aLogoImg, szLogoImg);
	@@ -1765,11 +1765,11 @@
1765	if( !g.perm.Setup ){
1766	login_needed(0);
1767	return;
1768	}
1769	add_content_sql_commands(g.db);
1770	zQ = cgi_csrf_safe(1) ? P("q") : 0;
1771	style_set_current_feature("setup");
1772	style_header("Raw SQL Commands");
1773	@ <p><b>Caution:</b> There are no restrictions on the SQL that can be
1774	@ run by this page. You can do serious and irrepairable damage to the
1775	@ repository. Proceed with extreme caution.</p>
	@@ -2122,11 +2122,11 @@
2122	Blob *pSql,
2123	const char *zOldName,
2124	const char *zNewName,
2125	const char *zValue
2126	){
2127	if( !cgi_csrf_safe(1) ) return;
2128	if( zNewName[0]==0 \|\| zValue[0]==0 ){
2129	if( zOldName[0] ){
2130	blob_append_sql(pSql,
2131	"DELETE FROM config WHERE name='walias:%q';\n",
2132	zOldName);
2133

	--- src/setup.c
	+++ src/setup.c
	@@ -1454,11 +1454,11 @@
1454	if( !g.perm.Admin ){
1455	login_needed(0);
1456	return;
1457	}
1458	db_begin_transaction();
1459	if( P("clear")!=0 && cgi_csrf_safe(2) ){
1460	db_unprotect(PROTECT_CONFIG);
1461	db_multi_exec("DELETE FROM config WHERE name GLOB 'adunit*'");
1462	db_protect_pop();
1463	cgi_replace_parameter("adunit","");
1464	cgi_replace_parameter("adright","");
	@@ -1556,11 +1556,11 @@
1556	if( !g.perm.Admin ){
1557	login_needed(0);
1558	return;
1559	}
1560	db_begin_transaction();
1561	if( !cgi_csrf_safe(2) ){
1562	/* Allow no state changes if not safe from CSRF */
1563	}else if( P("setlogo")!=0 && zLogoMime && zLogoMime[0] && szLogoImg>0 ){
1564	Blob img;
1565	Stmt ins;
1566	blob_init(&img, aLogoImg, szLogoImg);
	@@ -1765,11 +1765,11 @@
1765	if( !g.perm.Setup ){
1766	login_needed(0);
1767	return;
1768	}
1769	add_content_sql_commands(g.db);
1770	zQ = cgi_csrf_safe(2) ? P("q") : 0;
1771	style_set_current_feature("setup");
1772	style_header("Raw SQL Commands");
1773	@ <p><b>Caution:</b> There are no restrictions on the SQL that can be
1774	@ run by this page. You can do serious and irrepairable damage to the
1775	@ repository. Proceed with extreme caution.</p>
	@@ -2122,11 +2122,11 @@
2122	Blob *pSql,
2123	const char *zOldName,
2124	const char *zNewName,
2125	const char *zValue
2126	){
2127	if( !cgi_csrf_safe(2) ) return;
2128	if( zNewName[0]==0 \|\| zValue[0]==0 ){
2129	if( zOldName[0] ){
2130	blob_append_sql(pSql,
2131	"DELETE FROM config WHERE name='walias:%q';\n",
2132	zOldName);
2133

M src/setupuser.c

+1 -1

		--- src/setupuser.c
		+++ src/setupuser.c
		@@ -342,11 +342,11 @@
342	342	cgi_redirect(cgi_referer("setup_ulist"));
343	343	return;
344	344	}
345	345
346	346	/* Check for requests to delete the user */
347		- if( P("delete") && cgi_csrf_safe(1) ){
	347	+ if( P("delete") && cgi_csrf_safe(2) ){
348	348	int n;
349	349	if( P("verifydelete") ){
350	350	/* Verified delete user request */
351	351	db_unprotect(PROTECT_USER);
352	352	if( alert_tables_exist() ){
353	353

	--- src/setupuser.c
	+++ src/setupuser.c
	@@ -342,11 +342,11 @@
342	cgi_redirect(cgi_referer("setup_ulist"));
343	return;
344	}
345
346	/* Check for requests to delete the user */
347	if( P("delete") && cgi_csrf_safe(1) ){
348	int n;
349	if( P("verifydelete") ){
350	/* Verified delete user request */
351	db_unprotect(PROTECT_USER);
352	if( alert_tables_exist() ){
353

	--- src/setupuser.c
	+++ src/setupuser.c
	@@ -342,11 +342,11 @@
342	cgi_redirect(cgi_referer("setup_ulist"));
343	return;
344	}
345
346	/* Check for requests to delete the user */
347	if( P("delete") && cgi_csrf_safe(2) ){
348	int n;
349	if( P("verifydelete") ){
350	/* Verified delete user request */
351	db_unprotect(PROTECT_USER);
352	if( alert_tables_exist() ){
353

M src/style.c

+20 -1

		--- src/style.c
		+++ src/style.c
		@@ -1460,11 +1460,30 @@
1460	1460	@ g.zRepositoryName = %h(g.zRepositoryName)<br>
1461	1461	@ load_average() = %f(load_average())<br>
1462	1462	#ifndef _WIN32
1463	1463	@ RSS = %.2f(fossil_rss()/1000000.0) MB</br>
1464	1464	#endif
1465		- @ cgi_csrf_safe(0) = %d(cgi_csrf_safe(0))<br>
	1465	+ (void)cgi_csrf_safe(2);
	1466	+ switch( g.okCsrf ){
	1467	+ case 1: {
	1468	+ @ CSRF safety = Same origin<br>
	1469	+ break;
	1470	+ }
	1471	+ case 2: {
	1472	+ @ CSRF safety = Same origin, POST<br>
	1473	+ break;
	1474	+ }
	1475	+ case 3: {
	1476	+ @ CSRF safety = Same origin, POST, CSRF token<br>
	1477	+ break;
	1478	+ }
	1479	+ default: {
	1480	+ @ CSRF safety = unsafe<br>
	1481	+ break;
	1482	+ }
	1483	+ }
	1484	+
1466	1485	@ fossil_exe_id() = %h(fossil_exe_id())<br>
1467	1486	if( g.perm.Admin ){
1468	1487	int k;
1469	1488	for(k=0; g.argvOrig[k]; k++){
1470	1489	Blob t;
1471	1490

	--- src/style.c
	+++ src/style.c
	@@ -1460,11 +1460,30 @@
1460	@ g.zRepositoryName = %h(g.zRepositoryName)<br>
1461	@ load_average() = %f(load_average())<br>
1462	#ifndef _WIN32
1463	@ RSS = %.2f(fossil_rss()/1000000.0) MB</br>
1464	#endif
1465	@ cgi_csrf_safe(0) = %d(cgi_csrf_safe(0))<br>



















1466	@ fossil_exe_id() = %h(fossil_exe_id())<br>
1467	if( g.perm.Admin ){
1468	int k;
1469	for(k=0; g.argvOrig[k]; k++){
1470	Blob t;
1471

	--- src/style.c
	+++ src/style.c
	@@ -1460,11 +1460,30 @@
1460	@ g.zRepositoryName = %h(g.zRepositoryName)<br>
1461	@ load_average() = %f(load_average())<br>
1462	#ifndef _WIN32
1463	@ RSS = %.2f(fossil_rss()/1000000.0) MB</br>
1464	#endif
1465	(void)cgi_csrf_safe(2);
1466	switch( g.okCsrf ){
1467	case 1: {
1468	@ CSRF safety = Same origin<br>
1469	break;
1470	}
1471	case 2: {
1472	@ CSRF safety = Same origin, POST<br>
1473	break;
1474	}
1475	case 3: {
1476	@ CSRF safety = Same origin, POST, CSRF token<br>
1477	break;
1478	}
1479	default: {
1480	@ CSRF safety = unsafe<br>
1481	break;
1482	}
1483	}
1484
1485	@ fossil_exe_id() = %h(fossil_exe_id())<br>
1486	if( g.perm.Admin ){
1487	int k;
1488	for(k=0; g.argvOrig[k]; k++){
1489	Blob t;
1490

Fossil SCM

Keyboard Shortcuts