checksessionexpiry: rework

This function as factored out was a bit confusing, I think this makes more
sense.

diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm
index a3486cbb40034cafc2fcdedd32c828626261339d..a45e12e3168c54540b22f72e95c28d35eef003e5 100644 (file)
--- a/IkiWiki/CGI.pm
+++ b/IkiWiki/CGI.pm
@@ -36,7 +36,7 @@ sub showform ($$$$;@) { #{{{
 
        printheader($session);
        print misctemplate($form->title, $form->render(submit => $buttons), @_);
 
        printheader($session);
        print misctemplate($form->title, $form->render(submit => $buttons), @_);

-}
+} #}}}

 
 sub redirect ($$) { #{{{
        my $q=shift;
 
 sub redirect ($$) { #{{{
        my $q=shift;


@@ -273,7 +273,7 @@ sub check_banned ($$) { #{{{
                        exit;
                }
        }
                        exit;
                }
        }

-}
+} #}}}

 
 sub cgi_getsession ($) { #{{{
        my $q=shift;
 
 sub cgi_getsession ($) { #{{{
        my $q=shift;


@@ -296,14 +296,16 @@ sub cgi_getsession ($) { #{{{
        return $session;
 } #}}}
 
        return $session;
 } #}}}
 

-# The session id is stored on the form and checked to
-# guard against CSRF. But only if the user is logged in,
-# as anonok can allow anonymous edits.
+# To guard against CSRF, the user's session id (sid)
+# can be stored on a form. This function will check
+# (for logged in users) that the sid on the form matches
+# the session id in the cookie.

 sub checksessionexpiry ($$) { # {{{
 sub checksessionexpiry ($$) { # {{{

+       my $q=shift;

        my $session = shift;
        my $session = shift;

-       my $sid = shift;

 
        if (defined $session->param("name")) {
 
        if (defined $session->param("name")) {

+               my $sid=$q->param('sid');

                if (! defined $sid || $sid ne $session->id) {
                        error(gettext("Your login session has expired."));
                }
                if (! defined $sid || $sid ne $session->id) {
                        error(gettext("Your login session has expired."));
                }

diff --git a/IkiWiki/Plugin/comments.pm b/IkiWiki/Plugin/comments.pm
index 1eb256da9bc5ec3e198025fa81c3ffe3b3c65dfb..b8748a1d65e188abefee86cde10110356c941b5a 100644 (file)
--- a/IkiWiki/Plugin/comments.pm
+++ b/IkiWiki/Plugin/comments.pm
@@ -468,7 +468,7 @@ sub sessioncgi ($$) { #{{{
        if ($form->submitted eq POST_COMMENT && $form->validate) {
                my $file = "$location._comment";
 
        if ($form->submitted eq POST_COMMENT && $form->validate) {
                my $file = "$location._comment";
 

-               IkiWiki::checksessionexpiry($session, $cgi->param('sid'));
+               IkiWiki::checksessionexpiry($cgi, $session);

 
                # FIXME: could probably do some sort of graceful retry
                # on error? Would require significant unwinding though
 
                # FIXME: could probably do some sort of graceful retry
                # on error? Would require significant unwinding though

diff --git a/IkiWiki/Plugin/editpage.pm b/IkiWiki/Plugin/editpage.pm
index e4f0cdac09de50f2e3d312e3b9ad97089464d702..242624d77fb89ae03bed3b6970498673a6137613 100644 (file)
--- a/IkiWiki/Plugin/editpage.pm
+++ b/IkiWiki/Plugin/editpage.pm
@@ -340,7 +340,7 @@ sub cgi_editpage ($$) { #{{{
        else {
                # save page
                check_canedit($page, $q, $session);
        else {
                # save page
                check_canedit($page, $q, $session);

-               checksessionexpiry($session, $q->param('sid'));
+               checksessionexpiry($q, $session, $q->param('sid'));

 
                my $exists=-e "$config{srcdir}/$file";
 
 
                my $exists=-e "$config{srcdir}/$file";