diff options
| author | Mark Sapiro <mark@msapiro.net> | 2021-11-30 09:50:49 -0800 |
|---|---|---|
| committer | Mark Sapiro <mark@msapiro.net> | 2021-11-30 09:50:49 -0800 |
| commit | a306294cf9e4d4a4ded2c840f9a1ce8ba412b6a7 (patch) | |
| tree | 9f8f2843bf72bc8cfabe4d752eb7914e535d8f08 /Mailman/Cgi/admindb.py | |
| parent | f63f8d81d718d779dd6cdb55c66bf3def0fe9041 (diff) | |
| download | mailman2-a306294cf9e4d4a4ded2c840f9a1ce8ba412b6a7.tar.gz mailman2-a306294cf9e4d4a4ded2c840f9a1ce8ba412b6a7.tar.xz mailman2-a306294cf9e4d4a4ded2c840f9a1ce8ba412b6a7.zip | |
Block CSRF attack against admin or admindb pages.
Diffstat (limited to 'Mailman/Cgi/admindb.py')
| -rw-r--r-- | Mailman/Cgi/admindb.py | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/Mailman/Cgi/admindb.py b/Mailman/Cgi/admindb.py index 45ba6492..a210efd9 100644 --- a/Mailman/Cgi/admindb.py +++ b/Mailman/Cgi/admindb.py @@ -144,7 +144,8 @@ def main(): safe_params = ['adminpw', 'admlogin', 'msgid', 'sender', 'details'] params = cgidata.keys() if set(params) - set(safe_params): - csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token')) + csrf_checked = csrf_check(mlist, cgidata.getfirst('csrf_token'), + 'admindb') else: csrf_checked = True # if password is present, void cookie to force password authentication. |