#7371 Add missing CSRF check (profile image upload)

pkp · Oct 19, 2021 · 3018049 · 3018049
1 parent af18ffb
commit 3018049
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/classes/user/form/PublicProfileForm.inc.php b/classes/user/form/PublicProfileForm.inc.php
@@ -75,6 +75,10 @@ public function readInputData()
      */
     public function uploadProfileImage()
     {
+        if (!Application::get()->getRequest()->checkCSRF()) {
+            throw new \Exception('CSRF mismatch!');
+        }
+
         $publicFileManager = new PublicFileManager();
 
         $user = $this->getUser();

diff --git a/templates/user/publicProfileForm.tpl b/templates/user/publicProfileForm.tpl
@@ -26,6 +26,9 @@
 							{ldelim} title : "Image files", extensions : "jpg,jpeg,png,svg,gif" {rdelim}
 						]
 					{rdelim},
+					multipart_params: {ldelim}
+						csrfToken: {csrf type="json"}
+					{rdelim},
 					resize: {ldelim}
 						width: {$profileImageMaxWidth|intval},
 						height: {$profileImageMaxHeight|intval},