CSRF protection (#44)

2018-11-25 21:25:27 +01:00
parent d452b139d7
commit d8a5cc54f6
3 changed files with 34 additions and 7 deletions
--- a/sources/controller.php
+++ b/sources/controller.php
@@ -117,6 +117,11 @@ dispatch('/', function() {
 });

 dispatch_put('/settings', function() {
+
+  if(!isset($_SERVER['HTTP_X_REQUESTED_WITH'])) {
+    throw new Exception('CSRF protection');
+  }
+
  $service_enabled = isset($_POST['service_enabled']) ? 1 : 0;

  if($service_enabled == 1) {