We are no longer offering accounts on this server. Consider https://gitlab.freedesktop.org/ as a place to host projects.

Commit d6dd35a6 authored by Evan Prodromou's avatar Evan Prodromou

add a token for CSRF avoidance

parent 93e67c71
......@@ -28,6 +28,11 @@ class FinishopenidloginAction extends Action {
if (common_logged_in()) {
common_user_error(_('Already logged in.'));
} else if ($_SERVER['REQUEST_METHOD'] == 'POST') {
$token = $this->trimmed('token');
if (!$token || $token != common_session_token()) {
$this->show_form(_('There was a problem with your session token. Try again, please.'));
if ($this->arg('create')) {
if (!$this->boolean('license')) {
$this->show_form(_('You can\'t register if you don\'t agree to the license.'),
......@@ -64,6 +69,7 @@ class FinishopenidloginAction extends Action {
common_element_start('form', array('method' => 'post',
'id' => 'account_connect',
'action' => common_local_url('finishopenidlogin')));
common_hidden('token', common_session_token());
common_element('h2', NULL,
_('Create new account'));
common_element('p', NULL,
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment