From 8484ce22584b8714622833adcc7ebfe3ef9cf90e Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <fox@madoka.volgo-balt.ru>
Date: Mon, 26 Dec 2011 12:02:52 +0400
Subject: experimental CSRF protection

---
 classes/pref_users.php | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

(limited to 'classes/pref_users.php')

diff --git a/classes/pref_users.php b/classes/pref_users.php
index b9d162fd2..fe32ce14c 100644
--- a/classes/pref_users.php
+++ b/classes/pref_users.php
@@ -1,6 +1,5 @@
 <?php
 class Pref_Users extends Protected_Handler {
-
 		function before() {
 			if (parent::before()) {
 				if ($_SESSION["access_level"] < 10) {
@@ -12,6 +11,12 @@ class Pref_Users extends Protected_Handler {
 			return false;
 		}
 
+		function csrf_ignore($method) {
+			$csrf_ignored = array("index");
+
+			return array_search($method, $csrf_ignored) !== false;
+		}
+
 		function userdetails() {
 
 			header("Content-Type: text/xml");
-- 
cgit v1.2.3-54-g00ecf