search

OpenRA / openrauseraccounts

Connect phpBB forum accounts to OpenRA installations
https://forum.openra.net/ucp.php?i=232
GNU General Public License v2.0
3 stars 3 forks source link

Check form key within each mode instead of class #6

Closed ghost closed 6 years ago

ghost commented 6 years ago

Form key handling needs more investigation. The form key is currently only checked for submitting keys and not for revoking keys in the manage keys mode. Revoking keys is mainly based on how log entries are deleted from mcp logs and there the form key is not checked. However, the form key is checked in some other very similar pieces of code, for example when deleting entries in acp_users.php at Ln. 1186 which uses a very similar method. Due to this inconsistent handling in the phpbb code the recommended method is unknown at the moment.

ghost commented 6 years ago

The form key does not need to be checked when using a confirm box. https://wiki.phpbb.com/Function.confirm_box