Changeset 14993 for branches/rel

Timestamp:

2007/06/28 17:24:05 (16 years ago)

Author:

adati

Message:

CSRF対策：システム＞メンバー管理の脆弱性を修正

Location:

branches/rel

Files:

• data/Smarty/templates/admin/system/input.tpl (modified) (1 diff)
• html/admin/system/input.php (modified) (3 diffs)

branches/rel/data/Smarty/templates/admin/system/input.tpl

@@ -42 +42 @@
 <input type="hidden" name="pageno" value="<!--{$tpl_pageno}-->">
 <input type="hidden" name="old_login_id" value="<!--{$tpl_old_login_id}-->">
+<input type="hidden" name="uniqid" value="<!--{$tpl_uniqid}-->">
     <tr valign="top">
         <td class="mainbg">

branches/rel/html/admin/system/input.php

@@ -49 +49 @@
     // ¥í¥°¥¤¥óID¤òÊݴɤ·¤Æ¤ª¤¯¡£
     $objPage->tpl_old_login_id = $data_list[0]['login_id'];
+    
+    $objPage->tpl_uniqid = $objSess->getUniqId();
 } else {
     // ¿·µ¬ºîÀ®¥â¡¼¥É
@@ -57 +59 @@
 // ¿·µ¬ºîÀ®¥â¡¼¥É or ÊÔ½¸¥â¡¼¥É
 if( $_POST['mode'] == 'new' || $_POST['mode'] == 'edit') {
-    // ÆþÎÏ¥¨¥é¡¼¥Á¥§¥Ã¥¯
+    // ²èÌÌÁ«°Ü¤ÎÀµÅöÀ­¥Á¥§¥Ã¥¯
+    if (sfIsValidTransition($objSess) == false) {
+        sfDispError(INVALID_MOVE_ERRORR);
+    }
+    // ÆþÎÏ¥¨¥é¡¼¥Á¥§¥Ã¥¯
     $objPage->arrErr = fnErrorCheck($conn);
     
@@ -98 +104 @@
     $objPage->tpl_onload="fnUpdateParent('".$url."')";
 }
+
+// ²èÌÌÁ«°Ü¤ÎÀµÅöÀ­¥Á¥§¥Ã¥¯ÍѤËuniqid¤òËä¤á¹þ¤à
+$objPage->tpl_uniqid = $objSess->getUniqId();
 
 // ¥Æ¥ó¥×¥ì¡¼¥ÈÍÑÊÑ¿ô¤Î³ä¤êÅö¤Æ