Missing csfr check

LiveHelperChat · Jan 13, 2022 · f59ffb0 · f59ffb0
1 parent 58df43e
commit f59ffb0
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/lhc_web/modules/lhaudit/configuration.php b/lhc_web/modules/lhaudit/configuration.php
@@ -7,6 +7,11 @@
 
 if ( isset($_POST['StoreOptions']) ) {
 
+    if (!isset($_POST['csfr_token']) || !$currentUser->validateCSFRToken($_POST['csfr_token'])) {
+        erLhcoreClassModule::redirect();
+        exit;
+    }
+
     $definition = array(
         'days_log' => new ezcInputFormDefinitionElement(ezcInputFormDefinitionElement::OPTIONAL, 'int'),
         'log_js' => new ezcInputFormDefinitionElement(ezcInputFormDefinitionElement::OPTIONAL, 'boolean'),