Changeset 14990 for branches/rel/data

Timestamp:

2007/06/28 16:46:22 (17 years ago)

Author:

adati

Message:

CSRF対策：sfIsValidTransition()の追加、画面遷移の正当性をチェックする

File:

• branches/rel/data/lib/slib.php (modified) (2 diffs)

branches/rel/data/lib/slib.php

@@ -465 +465 @@
 
 /* ǧ¾Ú¤Î²ÄÈÝȽÄê */
-function sfIsSuccess($objSess, $disp_error = true) { 
+function sfIsSuccess($objSess, $disp_error = true) {
     $ret = $objSess->IsSuccess();
     if($ret != SUCCESS) {
@@ -503 +503 @@
     // $_SERVER['HTTPS'] != 'off' ¤ÏIISÍÑ
     if (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] != 'off') {
+        return true;
+    } else {
+        return false;
+    }
+}
+
+/**
+ *  Àµµ¬¤ÎÁ«°Ü¤¬¤µ¤ì¤Æ¤¤¤ë¤«¤òȽÄê
+ *  Á°²èÌ̤Çuniqid¤òËä¤á¹þ¤ó¤Ç¤ª¤¯É¬Íפ¬¤¢¤ë
+ *  @param  obj  SC_Session, SC_SiteSession
+ *  @return bool
+ */
+function sfIsValidTransition($objSess) {
+    // Á°²èÌ̤«¤éPOST¤µ¤ì¤ëuniqid¤¬Àµ¤·¤¤¤â¤Î¤«¤É¤¦¤«¤ò¥Á¥§¥Ã¥¯
+    $uniqid = $objSess->getUniqId();
+    if ( !empty($_POST['uniqid']) && ($_POST['uniqid'] === $uniqid) ) {
         return true;
     } else {