diff options
Diffstat (limited to 'app/Models')
| -rw-r--r-- | app/Models/Auth.php | 21 | ||||
| -rw-r--r-- | app/Models/EntryDAOSQLite.php | 5 |
2 files changed, 24 insertions, 2 deletions
diff --git a/app/Models/Auth.php b/app/Models/Auth.php index d689f7cdb..b93942e19 100644 --- a/app/Models/Auth.php +++ b/app/Models/Auth.php @@ -124,6 +124,7 @@ class FreshRSS_Auth { self::$login_ok = false; $conf = Minz_Configuration::get('system'); Minz_Session::_param('currentUser', $conf->default_user); + Minz_Session::_param('csrf'); switch ($conf->auth_type) { case 'form': @@ -156,6 +157,26 @@ class FreshRSS_Auth { $auth_type = $conf->auth_type; return $auth_type === 'form'; } + + public static function csrfToken() { + $csrf = Minz_Session::param('csrf'); + if ($csrf == '') { + $salt = FreshRSS_Context::$system_conf->salt; + $csrf = sha1($salt . uniqid(mt_rand(), true)); + Minz_Session::_param('csrf', $csrf); + } + return $csrf; + } + public static function isCsrfOk($token = null) { + $csrf = Minz_Session::param('csrf'); + if ($csrf == '') { + return true; //Not logged in yet + } + if ($token === null) { + $token = Minz_Request::fetchPOST('_csrf'); + } + return $token === $csrf; + } } diff --git a/app/Models/EntryDAOSQLite.php b/app/Models/EntryDAOSQLite.php index ff049d813..19b97fd3a 100644 --- a/app/Models/EntryDAOSQLite.php +++ b/app/Models/EntryDAOSQLite.php @@ -2,11 +2,12 @@ class FreshRSS_EntryDAOSQLite extends FreshRSS_EntryDAO { - protected function autoAddColumn($errorInfo) { + protected function autoUpdateDb($errorInfo) { if (empty($errorInfo[0]) || $errorInfo[0] == '42S22') { //ER_BAD_FIELD_ERROR + //autoAddColumn if ($tableInfo = $this->bd->query("SELECT sql FROM sqlite_master where name='entry'")) { $showCreate = $tableInfo->fetchColumn(); - Minz_Log::debug('FreshRSS_EntryDAOSQLite::autoAddColumn: ' . $showCreate); + Minz_Log::debug('FreshRSS_EntryDAOSQLite::autoUpdateDb: ' . $showCreate); foreach (array('lastSeen', 'hash') as $column) { if (stripos($showCreate, $column) === false) { return $this->addColumn($column); |