Skip to content

Commit a150470

Browse files
Fix missing CSRF tokens for profile page (#1946)
#1640 fixed a slew of issues with the profile page, and completely overhauled the underlying code. This PR is a minimal patch to restore password-change functionality for CDash 3.2.
1 parent 9023936 commit a150470

2 files changed

Lines changed: 3 additions & 0 deletions

File tree

app/Http/Controllers/UserController.php

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -497,6 +497,7 @@ public function edit(): View
497497
$xml .= '<error>Your password has expired. Please set a new one.</error>';
498498
}
499499

500+
$xml .= '<csrf>' . csrf_token() . '</csrf>';
500501
$xml .= '</cdash>';
501502

502503
return view('cdash', [

app/cdash/public/editUser.xsl

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
<td colspan="5" id="nob"><h3>My Profile</h3></td>
1616
</tr>
1717
<form method="post" action="" name="updatprofile_form">
18+
<input type="hidden" name="_token"><xsl:attribute name="value"><xsl:value-of select="cdash/csrf"/></xsl:attribute></input>
1819
<tr class="treven">
1920
<td width="20%" height="2"><div align="right">First Name</div></td>
2021
<td width="80%" height="2" id="nob"><input class="textbox" name="fname" size="20">
@@ -50,6 +51,7 @@
5051
</tr>
5152
</form>
5253
<form method="post" action="" name="updatemail_form">
54+
<input type="hidden" name="_token"><xsl:attribute name="value"><xsl:value-of select="cdash/csrf"/></xsl:attribute></input>
5355
<tr class="trodd">
5456
<td width="20%" height="2" ><div align="right">Current Password</div></td>
5557
<td width="80%" height="2" id="nob"><input class="textbox" type="password" name="oldpasswd" size="20"/></td>

0 commit comments

Comments
 (0)