eck CSRF token in styling plugin. fixes #3560

dokuwiki · Dec 12, 2021 · 54bcc3a · 54bcc3a
1 parent 96f679f
commit 54bcc3a
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/lib/plugins/styling/admin.php b/lib/plugins/styling/admin.php
@@ -34,6 +34,7 @@ public function handle()
         global $INPUT;
         $run = $INPUT->extract('run')->str('run');
         if (!$run) return;
+        if(!checkSecurityToken()) return;
         $run = 'run'.ucfirst($run);
         $this->$run();
     }
@@ -76,6 +77,7 @@ public function form()
             echo $this->locale_xhtml('intro');
 
             echo '<form class="styling" method="post" action="'.$target.'">';
+            formSecurityToken();
 
             echo '<table><tbody>';
             foreach ($replacements as $key => $value) {