Difuse/luci
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

luci-app-splash: protect admin status call with csrf token

Browse source 
Signed-off-by: Jo-Philipp Wich <jow@openwrt.org>
This commit is contained in:
Jo-Philipp Wich 2015-10-21 00:09:55 +02:00
parent ac34dfa0bc
commit c1278f967e
2 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
applications/luci-app-splash/luasrc/controller/splash/splash.lua
View file

@ -16,7 +16,7 @@ function index()
node("splash", "splash").target = template("splash_splash/splash")
node("splash", "blocked").target = template("splash/blocked")
entry({"admin", "status", "splash"}, call("action_status_admin"), _("Client-Splash"))
entry({"admin", "status", "splash"}, post("action_status_admin"), _("Client-Splash"))
local page = node("splash", "publicstatus")
page.target = call("action_status_public")

2
applications/luci-app-splash/luasrc/view/admin_status/splash.htm
View file

@ -214,7 +214,7 @@ end
<fieldset id="cbi-table-table" class="cbi-section">
<legend><%:Active Clients%></legend>
<div class="cbi-section-node">
<% if is_admin then %><form action="<%=REQUEST_URI%>" method="post"><% end %>
<% if is_admin then %><form action="<%=REQUEST_URI%>" method="post"><input type="hidden" name="token" value="<%=token%>" /><% end %>
<table class="cbi-section-table">
<thead>
<tr class="cbi-section-table-titles">