Require CSRF token when changing settings

2026-04-24 18:59:48 +01:00 · 2017-04-02 20:04:39 -04:00
parent 4d9d9dc949
commit fe7f3d3873
2 changed files with 12 additions and 0 deletions
--- a/scripts/pi-hole/php/savesettings.php
+++ b/scripts/pi-hole/php/savesettings.php
@@ -130,6 +130,9 @@ function isinserverlist($addr) {

 	if(isset($_POST["field"]))
 	{
+		// Handle CSRF
+		check_csrf(isset($_POST["token"]) ? $_POST["token"] : "");
+
 		// Process request
 		switch ($_POST["field"]) {
 			// Set DNS server