Strict Referer domain against XSRF

https://github.com/marienfressinaud/FreshRSS/issues/554
10 years ago · a0930a5ad6
parent d3f730287d
commit a0930a5ad6
1 changed files with 2 additions and 2 deletions
--- a/app/FreshRSS.php
+++ b/app/FreshRSS.php
@ -6,8 +6,8 @@ class FreshRSS extends Minz_FrontController {
 		}
 		$loginOk = $this->accessControl(Minz_Session::param('currentUser', ''));
 		$this->loadParamsView();
-		if (Minz_Request::isPost() && !empty($_SERVER['HTTP_REFERER']) &&
-			Minz_Request::getDomainName() !== parse_url($_SERVER['HTTP_REFERER'], PHP_URL_HOST)) {
+		if (Minz_Request::isPost() && (empty($_SERVER['HTTP_REFERER']) ||
+			Minz_Request::getDomainName() !== parse_url($_SERVER['HTTP_REFERER'], PHP_URL_HOST))) {
 			$loginOk = false;	//Basic protection against XSRF attacks
 			Minz_Error::error(
 				403,