search

csphere-cms / cSphere

Generic PHP Web-CMS with low footprint and high extensibility
Other
17 stars 7 forks source link

simple csrf protection #10

Open hajo-p opened 10 years ago

laszlokorte commented 10 years ago

Currently records (users, tags) can be deleted via GET request...

hajo-p commented 10 years ago

csrf won't stop that, it's up to the access control to defend such things. access control is not implemented yet, but will be before first rc is out.

DSchalla commented 10 years ago

That's wrong. CSRF is exactly the attack vector which avoids easily access control, since you attack with the rights of the user. @laszlokorte is correct with that.