From 9ddefa979a12aff2334d6e7048e142cfdef5bb89 Mon Sep 17 00:00:00 2001
From: Frédéric Guillot <fred@kanboard.net>
Date: Mon, 29 Jan 2018 15:56:30 -0800
Subject: Add CSRF check for task and project files upload

---
 app/Controller/BaseController.php | 7 +++++++
 1 file changed, 7 insertions(+)

(limited to 'app/Controller/BaseController.php')

diff --git a/app/Controller/BaseController.php b/app/Controller/BaseController.php
index 43ecfaab..1433ec14 100644
--- a/app/Controller/BaseController.php
+++ b/app/Controller/BaseController.php
@@ -26,6 +26,13 @@ abstract class BaseController extends Base
         }
     }
 
+    protected function checkReusableCSRFParam()
+    {
+        if (! $this->token->validateReusableCSRFToken($this->request->getRawValue('csrf_token'))) {
+            throw new AccessForbiddenException();
+        }
+    }
+
     /**
      * Check webhook token
      *
-- 
cgit v1.2.3