Proper way to fix CSRF in /schedule/backup/

myvesta · Aug 28, 2021 · 11f1cfc · 11f1cfc
1 parent 0336e8b
commit 11f1cfc
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 4 deletions.
diff --git a/web/schedule/backup/index.php b/web/schedule/backup/index.php
@@ -1,14 +1,18 @@
 <?php
 
-// Preventing CSRF
-prevent_post_csrf(true);
-
 // Init
 error_reporting(NULL);
 ob_start();
 session_start();
 include($_SERVER['DOCUMENT_ROOT']."/inc/main.php");
 
+// Check token
+if ((!isset($_GET['token'])) || ($_SESSION['token'] != $_GET['token'])) {
+    die($_SESSION['token']);
+    header('location: /login/');
+    exit();
+}
+
 $v_username = escapeshellarg($user);
 exec (VESTA_CMD."v-schedule-user-backup ".$v_username, $output, $return_var);
 if ($return_var == 0) {

diff --git a/web/templates/admin/list_backup.html b/web/templates/admin/list_backup.html
@@ -1,6 +1,6 @@
     <div class="l-center">
       <div class="l-sort clearfix noselect">
-        <a href="/schedule/backup/" class="l-sort__create-btn" title="<?=__('Create Backup')?>"></a>
+        <a href="/schedule/backup/?token=<?=$_SESSION['token']?>" class="l-sort__create-btn" title="<?=__('Create Backup')?>"></a>
         <div class="l-sort-toolbar clearfix">
           <table>
             <tr>