Temporary fix for a fat CSRF issue

theblacksea · Dec 30, 2013 · ac0fae4 · ac0fae4
1 parent 6f90cc6
commit ac0fae4
Show file tree

Hide file tree

Showing 2 changed files with 21 additions and 0 deletions.
diff --git a/config.local.php b/config.local.php
@@ -1,5 +1,11 @@
 <?php
 
+$origin = parse_url($_SERVER['HTTP_REFERER']);
+
+if($origin['host'] != 'theblacksea.eu') {
+        die('Warning, access forbidden!');
+}
+
 $publicDir = $_SERVER['DOCUMENT_ROOT'];
 $publicUrl = 'http://'.$_SERVER['HTTP_HOST'];
 

diff --git a/config.php b/config.php
@@ -147,4 +147,19 @@
     $_CONFIG =& $_DEFAULTS;
 }
 
+// Temporary fix for some CSRF issues
+// Deny all requests not coming from the same domain
+// FIXME: Refactor this, integrate in core app
+//
+// To apply this, copy and uncomment the following snippet to config.local.php
+
+/*
+$origin = parse_url($_SERVER['HTTP_REFERER']);
+
+if($origin['host'] != 'theblacksea.eu') {
+        die('Warning, access forbidden!');
+}
+*/
+
+
 ?>