This function as factored out was a bit confusing, I think this makes more
sense.
printheader($session);
print misctemplate($form->title, $form->render(submit => $buttons), @_);
printheader($session);
print misctemplate($form->title, $form->render(submit => $buttons), @_);
sub redirect ($$) { #{{{
my $q=shift;
sub redirect ($$) { #{{{
my $q=shift;
sub cgi_getsession ($) { #{{{
my $q=shift;
sub cgi_getsession ($) { #{{{
my $q=shift;
-# The session id is stored on the form and checked to
-# guard against CSRF. But only if the user is logged in,
-# as anonok can allow anonymous edits.
+# To guard against CSRF, the user's session id (sid)
+# can be stored on a form. This function will check
+# (for logged in users) that the sid on the form matches
+# the session id in the cookie.
sub checksessionexpiry ($$) { # {{{
sub checksessionexpiry ($$) { # {{{
if (defined $session->param("name")) {
if (defined $session->param("name")) {
+ my $sid=$q->param('sid');
if (! defined $sid || $sid ne $session->id) {
error(gettext("Your login session has expired."));
}
if (! defined $sid || $sid ne $session->id) {
error(gettext("Your login session has expired."));
}
if ($form->submitted eq POST_COMMENT && $form->validate) {
my $file = "$location._comment";
if ($form->submitted eq POST_COMMENT && $form->validate) {
my $file = "$location._comment";
- IkiWiki::checksessionexpiry($session, $cgi->param('sid'));
+ IkiWiki::checksessionexpiry($cgi, $session);
# FIXME: could probably do some sort of graceful retry
# on error? Would require significant unwinding though
# FIXME: could probably do some sort of graceful retry
# on error? Would require significant unwinding though
else {
# save page
check_canedit($page, $q, $session);
else {
# save page
check_canedit($page, $q, $session);
- checksessionexpiry($session, $q->param('sid'));
+ checksessionexpiry($q, $session, $q->param('sid'));
my $exists=-e "$config{srcdir}/$file";
my $exists=-e "$config{srcdir}/$file";