Changeset 14949 for branches/rel/html/mypage/refusal.php

Timestamp:

2007/06/28 11:15:24 (16 years ago)

Author:

adati

Message:

CSRF対策：マイページで退会手続きが実行されないように修正

File:

• branches/rel/html/mypage/refusal.php (modified) (3 diffs)

branches/rel/html/mypage/refusal.php

@@ -22 +22 @@
 $objCustomer = new SC_Customer();
 $objQuery = new SC_Query();
+$objSiteSess = new SC_SiteSession();
 
 //¥í¥°¥¤¥óȽÄê
@@ -39 +40 @@
 switch ($_POST['mode']){
     case 'confirm':
+    
     $objPage->tpl_mainpage = USER_PATH . 'templates/mypage/refusal_confirm.tpl';
     $objPage->tpl_title = "MY¥Ú¡¼¥¸/Âà²ñ¼ê³¤­(³Îǧ¥Ú¡¼¥¸)";
-
+    
+    // ³Îǧ¥Ú¡¼¥¸¤ò·Ðͳ¤·¤¿¤³¤È¤òÅÐÏ¿
+    $objSiteSess->setRegistFlag();
+    // hidden¤Ëuniqid¤òËä¤á¹þ¤à
+    $objPage->tpl_uniqid = $objSiteSess->getUniqId();
+    
     break;
     
     case 'complete':
+    // Àµ¤·¤¤Á«°Ü¤«¤É¤¦¤«¤ò¥Á¥§¥Ã¥¯
+    lfIsValidMovement($objSiteSess);
+    
     //²ñ°÷ºï½ü
     $objQuery->exec("UPDATE dtb_customer SET del_flg=1, update_date=now() WHERE customer_id=?", array($objCustomer->getValue('customer_id')));
@@ -57 +67 @@
 $objView->display(SITE_FRAME);
 
+// Àµ¤·¤¤Á«°Ü¤«¤É¤¦¤«¤ò¥Á¥§¥Ã¥¯
+function lfIsValidMovement($objSiteSess) {
+    // ³Îǧ¥Ú¡¼¥¸¤«¤é¤ÎÁ«°Ü¤«¤É¤¦¤«¤ò¥Á¥§¥Ã¥¯
+    sfIsPrePage($objSiteSess);
+    
+    // uniqid ¤¬POST¤µ¤ì¤Æ¤¤¤ë¤«¤ò¥Á¥§¥Ã¥¯
+    $uniqid = $objSiteSess->getUniqId();
+    if ( !empty($_POST['uniqid']) && ($_POST['uniqid'] === $uniqid) ) {
+        return;
+    } else {
+        sfDispSiteError(PAGE_ERROR, $objSiteSess);
+    }
+}
 ?>