From 154417d80b9f1ffb9d5d9fcbe2e6ab1dd15159bd Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <noreply@fakecake.org>
Date: Tue, 15 Sep 2020 16:59:11 +0300
Subject: public/logout: require valid CSRF token

---
 classes/handler/public.php | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

(limited to 'classes/handler')

diff --git a/classes/handler/public.php b/classes/handler/public.php
index e4199a95e..8b1ce7127 100755
--- a/classes/handler/public.php
+++ b/classes/handler/public.php
@@ -283,8 +283,10 @@ class Handler_Public extends Handler {
 	}
 
 	function logout() {
-		logout_user();
-		header("Location: index.php");
+		if ($_POST["csrf_token"] == $_SESSION["csrf_token"]) {
+			logout_user();
+			header("Location: index.php");
+		}
 	}
 
 	function share() {
-- 
cgit v1.2.3-54-g00ecf