diff options
| author | Andrew Dolgov <[email protected]> | 2020-09-15 16:59:11 +0300 |
|---|---|---|
| committer | Andrew Dolgov <[email protected]> | 2020-09-15 16:59:11 +0300 |
| commit | 154417d80b9f1ffb9d5d9fcbe2e6ab1dd15159bd (patch) | |
| tree | 184c060c78dadf9fc50b6512a74ec31789d67162 /classes/handler/public.php | |
| parent | cbcb10a272ef8c46360da301e1bbbd4979d6f106 (diff) | |
public/logout: require valid CSRF token
Diffstat (limited to 'classes/handler/public.php')
| -rwxr-xr-x | classes/handler/public.php | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/classes/handler/public.php b/classes/handler/public.php index e4199a95e..8b1ce7127 100755 --- a/classes/handler/public.php +++ b/classes/handler/public.php @@ -283,8 +283,10 @@ class Handler_Public extends Handler { } function logout() { - logout_user(); - header("Location: index.php"); + if ($_POST["csrf_token"] == $_SESSION["csrf_token"]) { + logout_user(); + header("Location: index.php"); + } } function share() { |