[SCM] Samba Shared Repository - branch v3-5-test updated

Karolin Seeger kseeger at samba.org
Tue Jul 26 12:47:31 MDT 2011


The branch, v3-5-test has been updated
       via  7b8ba88 WHATSNEW: Start release notes for 3.5.11.
       via  e95cb39 VERSION: Bump version up to 3.5.11.
       via  bcb052c s3-swat: Fix typo.
       via  4cfe6ad s3 swat: Create random nonce in CGI mode
       via  f537824 s3 swat: Add time component to XSRF token
       via  04c8584 s3 swat: Add XSRF protection to printer page
       via  805fa37 s3 swat: Add XSRF protection to password page
       via  623e86e s3 swat: Add XSRF protection to shares page
       via  75fc7f7 s3 swat: Add XSRF protection to globals page
       via  1252b96 s3 swat: Add XSRF protection to wizard page
       via  4afa481 s3 swat: Add XSRF protection to wizard_params page
       via  89a08cc s3 swat: Add XSRF protection to viewconfig page
       via  934015e s3 swat: Add XSRF protection to status page
       via  c3d9c41 s3 swat: Add support for anti-XSRF token
       via  48c59a1 s3 swat: Allow getting the user's HTTP auth password
       via  4d3b2db s3 swat: Fix possible XSS attack (bug #8289)
      from  70e9d82 WHATSNEW: Add changes since 3.5.9.

http://gitweb.samba.org/?p=samba.git;a=shortlog;h=v3-5-test


- Log -----------------------------------------------------------------
commit 7b8ba88234333176067220a2c2bae63d3a385b40
Author: Karolin Seeger <kseeger at samba.org>
Date:   Tue Jul 26 20:39:28 2011 +0200

    WHATSNEW: Start release notes for 3.5.11.
    
    Karolin
    (cherry picked from commit 6ab1dc24d77a58d4c37cb816ce04762c1df7521c)

commit e95cb39141f6ae87a300765c215bd3e2a7b15b06
Author: Karolin Seeger <kseeger at samba.org>
Date:   Tue Jul 26 20:36:37 2011 +0200

    VERSION: Bump version up to 3.5.11.
    
    Karolin
    (cherry picked from commit b6678d3dbcba6a2ee4961d2565477d362035e1b3)

commit bcb052c29212954a3ed10c9f095c51e4e0a96af5
Author: Karolin Seeger <kseeger at samba.org>
Date:   Sun Jul 24 21:09:38 2011 +0200

    s3-swat: Fix typo.
    
    Thanks to Simo for reporting!
    
    Karolin
    (cherry picked from commit 9f73c1990a19daa899fa5345530a867e69a5be94)

commit 4cfe6adbc421262f1e55cfba159bc2d2260a9a99
Author: Kai Blin <kai at samba.org>
Date:   Tue Jul 12 08:08:24 2011 +0200

    s3 swat: Create random nonce in CGI mode
    
    In CGI mode, we don't get access to the user's password, which would
    reduce the hash used so far to parameters an attacker can easily guess.
    To work around this, read the nonce from secrets.tdb or generate one if
    it's not there.
    Also populate the C_user field so we can use that for token creation.
    
    Signed-off-by: Kai Blin <kai at samba.org>
    
    The last 12 patches address bug #8290 (CSRF vulnerability in SWAT).
    This addresses CVE-2011-2522 (Cross-Site Request Forgery in SWAT).
    (cherry picked from commit 0e17d8ef7e4004a0d35011c322b93b6da5811951)

commit f5378245192735bd0a53c0721f279a8d88d9488b
Author: Kai Blin <kai at samba.org>
Date:   Sat Jul 9 09:52:07 2011 +0200

    s3 swat: Add time component to XSRF token
    
    Signed-off-by: Kai Blin <kai at samba.org>
    (cherry picked from commit 227921871146563c1d57f9a8faa3b8354058740c)

commit 04c85840b5bba5cc9c35acb7931e08aa3a1270df
Author: Kai Blin <kai at samba.org>
Date:   Fri Jul 8 15:06:13 2011 +0200

    s3 swat: Add XSRF protection to printer page
    
    Signed-off-by: Kai Blin <kai at samba.org>
    (cherry picked from commit c287fe37acc8d8cd64ffc5227498f5950df64c2b)

commit 805fa37fc261efcd956c57715120fba3763b1811
Author: Kai Blin <kai at samba.org>
Date:   Fri Jul 8 15:05:38 2011 +0200

    s3 swat: Add XSRF protection to password page
    
    Signed-off-by: Kai Blin <kai at samba.org>
    (cherry picked from commit 01dec3486857243151a63c8f877a4258d5864869)

commit 623e86ee23bd133e8193fad31c4a001e6cefcfe6
Author: Kai Blin <kai at samba.org>
Date:   Fri Jul 8 15:04:48 2011 +0200

    s3 swat: Add XSRF protection to shares page
    
    Signed-off-by: Kai Blin <kai at samba.org>
    (cherry picked from commit ecf5f0e613ca7f908cc961e406033bcc842b097a)

commit 75fc7f727d713fa2f5a1915c03c152a029d034f6
Author: Kai Blin <kai at samba.org>
Date:   Fri Jul 8 15:04:12 2011 +0200

    s3 swat: Add XSRF protection to globals page
    
    Signed-off-by: Kai Blin <kai at samba.org>
    (cherry picked from commit 9482f46dd0e961145345bd2cdbb01fa35ec9f048)

commit 1252b9691414623851ad94d2c21875edfd64e210
Author: Kai Blin <kai at samba.org>
Date:   Fri Jul 8 15:03:44 2011 +0200

    s3 swat: Add XSRF protection to wizard page
    
    Signed-off-by: Kai Blin <kai at samba.org>
    (cherry picked from commit 02a58bf633f7cd0cb04747d09a8b0a720b5b39b5)

commit 4afa481d0821d4e90b65e947739e790f283c8dc6
Author: Kai Blin <kai at samba.org>
Date:   Fri Jul 8 15:03:15 2011 +0200

    s3 swat: Add XSRF protection to wizard_params page
    
    Signed-off-by: Kai Blin <kai at samba.org>
    (cherry picked from commit 19a697f189156fed86d9d78e8bb6667e764075af)

commit 89a08cc6658d37cb2e447d52c9683257b189b822
Author: Kai Blin <kai at samba.org>
Date:   Fri Jul 8 15:02:53 2011 +0200

    s3 swat: Add XSRF protection to viewconfig page
    
    Signed-off-by: Kai Blin <kai at samba.org>
    (cherry picked from commit eae32a3f33c7c555663f917d5fba71033c968511)

commit 934015e67f0299f885a20abc63d16253463f60e5
Author: Kai Blin <kai at samba.org>
Date:   Fri Jul 8 12:58:53 2011 +0200

    s3 swat: Add XSRF protection to status page
    
    Signed-off-by: Kai Blin <kai at samba.org>
    (cherry picked from commit 587002c21aa4e944bf6422d77ec3bc6240bf04d5)

commit c3d9c4161709422242b0c22b68829fceceda20c9
Author: Kai Blin <kai at samba.org>
Date:   Fri Jul 8 12:57:43 2011 +0200

    s3 swat: Add support for anti-XSRF token
    
    Signed-off-by: Kai Blin <kai at samba.org>
    (cherry picked from commit abaccc2a7b45f9c778c00597b2d927222a118f27)

commit 48c59a191dd4bd496bc51a15f06665949c9506f3
Author: Kai Blin <kai at samba.org>
Date:   Fri Jul 8 12:56:21 2011 +0200

    s3 swat: Allow getting the user's HTTP auth password
    
    Signed-off-by: Kai Blin <kai at samba.org>
    (cherry picked from commit 988f59f7eb512fbae5a6cab6ed1dbf32a5737fe7)

commit 4d3b2dbb580a69e1ac82860a47e35ec417d2cf25
Author: Kai Blin <kai at samba.org>
Date:   Thu Jul 7 10:03:33 2011 +0200

    s3 swat: Fix possible XSS attack (bug #8289)
    
    Nobuhiro Tsuji of NTT DATA SECURITY CORPORATION reported a possible XSS attack
    against SWAT, the Samba Web Administration Tool. The attack uses reflection to
    insert arbitrary content into the "change password" page.
    
    This patch fixes the reflection issue by not printing user-specified content on
    the website anymore.
    
    Signed-off-by: Kai Blin <kai at samba.org>
    
    CVE-2011-2694.
    (cherry picked from commit 4cd5237ed156bb5a288e865b5afc88a966e1f386)

-----------------------------------------------------------------------

Summary of changes:
 WHATSNEW.txt             |   47 ++++++++++++-
 source3/VERSION          |    2 +-
 source3/web/cgi.c        |   29 +++++++-
 source3/web/statuspage.c |    7 ++
 source3/web/swat.c       |  175 +++++++++++++++++++++++++++++++++++++--------
 source3/web/swat_proto.h |    6 ++
 6 files changed, 231 insertions(+), 35 deletions(-)


Changeset truncated at 500 lines:

diff --git a/WHATSNEW.txt b/WHATSNEW.txt
index 8963b2c..94c9b0d 100644
--- a/WHATSNEW.txt
+++ b/WHATSNEW.txt
@@ -1,4 +1,47 @@
                    ==============================
+                   Release Notes for Samba 3.5.11
+			   , 2011
+                   ==============================
+
+
+This is the latest stable release of Samba 3.5.
+
+Major enhancements in Samba 3.5.11 include:
+
+o  
+
+
+Changes since 3.5.10:
+--------------------
+
+
+o   
+
+
+######################################################################
+Reporting bugs & Development Discussion
+#######################################
+
+Please discuss this release on the samba-technical mailing list or by
+joining the #samba-technical IRC channel on irc.freenode.net.
+
+If you do report problems then please try to send high quality
+feedback. If you don't provide vital information to help us track down
+the problem then you will probably be ignored.  All bug reports should
+be filed under the Samba 3.5 product in the project's Bugzilla
+database (https://bugzilla.samba.org/).
+
+
+======================================================================
+== Our Code, Our Bugs, Our Responsibility.
+== The Samba Team
+======================================================================
+
+
+Release notes for older releases follow:
+----------------------------------------
+
+                   ==============================
                    Release Notes for Samba 3.5.10
 			   July 12, 2011
                    ==============================
@@ -65,8 +108,8 @@ database (https://bugzilla.samba.org/).
 ======================================================================
 
 
-Release notes for older releases follow:
-----------------------------------------
+----------------------------------------------------------------------
+
 
                    =============================
                    Release Notes for Samba 3.5.9
diff --git a/source3/VERSION b/source3/VERSION
index 1e20933..83bb2ce 100644
--- a/source3/VERSION
+++ b/source3/VERSION
@@ -25,7 +25,7 @@
 ########################################################
 SAMBA_VERSION_MAJOR=3
 SAMBA_VERSION_MINOR=5
-SAMBA_VERSION_RELEASE=10
+SAMBA_VERSION_RELEASE=11
 
 ########################################################
 # Bug fix releases use a letter for the patch revision #
diff --git a/source3/web/cgi.c b/source3/web/cgi.c
index cf91b02..0c8e9cb 100644
--- a/source3/web/cgi.c
+++ b/source3/web/cgi.c
@@ -19,6 +19,8 @@
 
 #include "includes.h"
 #include "web/swat_proto.h"
+#include "secrets.h"
+#include "../lib/util/util.h"
 
 #define MAX_VARIABLES 10000
 
@@ -42,6 +44,7 @@ static char *query_string;
 static const char *baseurl;
 static char *pathinfo;
 static char *C_user;
+static char *C_pass;
 static bool inetd_server;
 static bool got_request;
 
@@ -320,7 +323,23 @@ static void cgi_web_auth(void)
 		exit(0);
 	}
 
-	setuid(0);
+	C_user = SMB_STRDUP(user);
+
+	if (!setuid(0)) {
+		C_pass = secrets_fetch_generic("root", "SWAT");
+		if (C_pass == NULL) {
+			char *tmp_pass = NULL;
+			tmp_pass = generate_random_str(talloc_tos(), 16);
+			if (tmp_pass == NULL) {
+				printf("%sFailed to create random nonce for "
+				       "SWAT session\n<br>%s\n", head, tail);
+				exit(0);
+			}
+			secrets_store_generic("root", "SWAT", tmp_pass);
+			C_pass = SMB_STRDUP(tmp_pass);
+			TALLOC_FREE(tmp_pass);
+		}
+	}
 	setuid(pwd->pw_uid);
 	if (geteuid() != pwd->pw_uid || getuid() != pwd->pw_uid) {
 		printf("%sFailed to become user %s - uid=%d/%d<br>%s\n", 
@@ -388,6 +407,7 @@ static bool cgi_handle_authorization(char *line)
 			
 			/* Save the users name */
 			C_user = SMB_STRDUP(user);
+			C_pass = SMB_STRDUP(user_pass);
 			TALLOC_FREE(pass);
 			return True;
 		}
@@ -422,6 +442,13 @@ char *cgi_user_name(void)
         return(C_user);
 }
 
+/***************************************************************************
+return a ptr to the users password
+  ***************************************************************************/
+char *cgi_user_pass(void)
+{
+        return(C_pass);
+}
 
 /***************************************************************************
 handle a file download
diff --git a/source3/web/statuspage.c b/source3/web/statuspage.c
index 590be1d..cb5c57b 100644
--- a/source3/web/statuspage.c
+++ b/source3/web/statuspage.c
@@ -247,9 +247,14 @@ void status_page(void)
 	int nr_running=0;
 	bool waitup = False;
 	TALLOC_CTX *ctx = talloc_stackframe();
+	const char form_name[] = "status";
 
 	smbd_pid = pid_to_procid(pidfile_pid("smbd"));
 
+	if (!verify_xsrf_token(form_name)) {
+		goto output_page;
+	}
+
 	if (cgi_variable("smbd_restart") || cgi_variable("all_restart")) {
 		stop_smbd();
 		start_smbd();
@@ -326,9 +331,11 @@ void status_page(void)
 
 	initPid2Machine ();
 
+output_page:
 	printf("<H2>%s</H2>\n", _("Server Status"));
 
 	printf("<FORM method=post>\n");
+	print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
 
 	if (!autorefresh) {
 		printf("<input type=submit value=\"%s\" name=\"autorefresh\">\n", _("Auto Refresh"));
diff --git a/source3/web/swat.c b/source3/web/swat.c
index baffa44..3a88986 100644
--- a/source3/web/swat.c
+++ b/source3/web/swat.c
@@ -29,6 +29,7 @@
 
 #include "includes.h"
 #include "web/swat_proto.h"
+#include "../lib/crypto/md5.h"
 
 static int demo_mode = False;
 static int passwd_only = False;
@@ -50,6 +51,9 @@ static int iNumNonAutoPrintServices = 0;
 #define DISABLE_USER_FLAG "disable_user_flag"
 #define ENABLE_USER_FLAG "enable_user_flag"
 #define RHOST "remote_host"
+#define XSRF_TOKEN "xsrf"
+#define XSRF_TIME "xsrf_time"
+#define XSRF_TIMEOUT 300
 
 #define _(x) lang_msg_rotate(talloc_tos(),x)
 
@@ -138,6 +142,76 @@ static char *make_parm_name(const char *label)
 	return parmname;
 }
 
+void get_xsrf_token(const char *username, const char *pass,
+		    const char *formname, time_t xsrf_time, char token_str[33])
+{
+	struct MD5Context md5_ctx;
+	uint8_t token[16];
+	int i;
+
+	token_str[0] = '\0';
+	ZERO_STRUCT(md5_ctx);
+	MD5Init(&md5_ctx);
+
+	MD5Update(&md5_ctx, (uint8_t *)formname, strlen(formname));
+	MD5Update(&md5_ctx, (uint8_t *)&xsrf_time, sizeof(time_t));
+	if (username != NULL) {
+		MD5Update(&md5_ctx, (uint8_t *)username, strlen(username));
+	}
+	if (pass != NULL) {
+		MD5Update(&md5_ctx, (uint8_t *)pass, strlen(pass));
+	}
+
+	MD5Final(token, &md5_ctx);
+
+	for(i = 0; i < sizeof(token); i++) {
+		char tmp[3];
+
+		snprintf(tmp, sizeof(tmp), "%02x", token[i]);
+		strncat(token_str, tmp, sizeof(tmp));
+	}
+}
+
+void print_xsrf_token(const char *username, const char *pass,
+		      const char *formname)
+{
+	char token[33];
+	time_t xsrf_time = time(NULL);
+
+	get_xsrf_token(username, pass, formname, xsrf_time, token);
+	printf("<input type=\"hidden\" name=\"%s\" value=\"%s\">\n",
+	       XSRF_TOKEN, token);
+	printf("<input type=\"hidden\" name=\"%s\" value=\"%lld\">\n",
+	       XSRF_TIME, (long long int)xsrf_time);
+}
+
+bool verify_xsrf_token(const char *formname)
+{
+	char expected[33];
+	const char *username = cgi_user_name();
+	const char *pass = cgi_user_pass();
+	const char *token = cgi_variable_nonull(XSRF_TOKEN);
+	const char *time_str = cgi_variable_nonull(XSRF_TIME);
+	time_t xsrf_time = 0;
+	time_t now = time(NULL);
+
+	if (sizeof(time_t) == sizeof(int)) {
+		xsrf_time = atoi(time_str);
+	} else if (sizeof(time_t) == sizeof(long)) {
+		xsrf_time = atol(time_str);
+	} else if (sizeof(time_t) == sizeof(long long)) {
+		xsrf_time = atoll(time_str);
+	}
+
+	if (abs(now - xsrf_time) > XSRF_TIMEOUT) {
+		return false;
+	}
+
+	get_xsrf_token(username, pass, formname, xsrf_time, expected);
+	return (strncmp(expected, token, sizeof(expected)) == 0);
+}
+
+
 /****************************************************************************
   include a lump of html in a page 
 ****************************************************************************/
@@ -611,13 +685,20 @@ static void welcome_page(void)
 static void viewconfig_page(void)
 {
 	int full_view=0;
+	const char form_name[] = "viewconfig";
+
+	if (!verify_xsrf_token(form_name)) {
+		goto output_page;
+	}
 
 	if (cgi_variable("full_view")) {
 		full_view = 1;
 	}
 
+output_page:
 	printf("<H2>%s</H2>\n", _("Current Config"));
 	printf("<form method=post>\n");
+	print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
 
 	if (full_view) {
 		printf("<input type=submit name=\"normal_view\" value=\"%s\">\n", _("Normal View"));
@@ -637,18 +718,25 @@ static void viewconfig_page(void)
 static void wizard_params_page(void)
 {
 	unsigned int parm_filter = FLAG_WIZARD;
+	const char form_name[] = "wizard_params";
 
 	/* Here we first set and commit all the parameters that were selected
  	   in the previous screen. */
 
 	printf("<H2>%s</H2>\n", _("Wizard Parameter Edit Page"));
 
+	if (!verify_xsrf_token(form_name)) {
+		goto output_page;
+	}
+
 	if (cgi_variable("Commit")) {
 		commit_parameters(GLOBAL_SECTION_SNUM);
 		save_reload(-1);
 	}
 
+output_page:
 	printf("<form name=\"swatform\" method=post action=wizard_params>\n");
+	print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
 
 	if (have_write_access) {
 		printf("<input type=submit name=\"Commit\" value=\"Commit Changes\">\n");
@@ -684,6 +772,11 @@ static void wizard_page(void)
 	int have_home = -1;
 	int HomeExpo = 0;
 	int SerType = 0;
+	const char form_name[] = "wizard";
+
+	if (!verify_xsrf_token(form_name)) {
+		goto output_page;
+	}
 
 	if (cgi_variable("Rewrite")) {
 		(void) rewritecfg_file();
@@ -774,10 +867,12 @@ static void wizard_page(void)
 		winstype = 3;
 
 	role = lp_server_role();
-	
+
+output_page:
 	/* Here we go ... */
 	printf("<H2>%s</H2>\n", _("Samba Configuration Wizard"));
 	printf("<form method=post action=wizard>\n");
+	print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
 
 	if (have_write_access) {
 		printf("%s\n", _("The \"Rewrite smb.conf file\" button will clear the smb.conf file of all default values and of comments."));
@@ -846,9 +941,14 @@ static void globals_page(void)
 {
 	unsigned int parm_filter = FLAG_BASIC;
 	int mode = 0;
+	const char form_name[] = "globals";
 
 	printf("<H2>%s</H2>\n", _("Global Parameters"));
 
+	if (!verify_xsrf_token(form_name)) {
+		goto output_page;
+	}
+
 	if (cgi_variable("Commit")) {
 		commit_parameters(GLOBAL_SECTION_SNUM);
 		save_reload(-1);
@@ -861,7 +961,9 @@ static void globals_page(void)
 	if ( cgi_variable("AdvMode"))
 		mode = 1;
 
+output_page:
 	printf("<form name=\"swatform\" method=post action=globals>\n");
+	print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
 
 	ViewModeBoxes( mode );
 	switch ( mode ) {
@@ -901,11 +1003,17 @@ static void shares_page(void)
 	int mode = 0;
 	unsigned int parm_filter = FLAG_BASIC;
 	size_t converted_size;
+	const char form_name[] = "shares";
+
+	printf("<H2>%s</H2>\n", _("Share Parameters"));
+
+	if (!verify_xsrf_token(form_name)) {
+		goto output_page;
+	}
 
 	if (share)
 		snum = lp_servicenumber(share);
 
-	printf("<H2>%s</H2>\n", _("Share Parameters"));
 
 	if (cgi_variable("Commit") && snum >= 0) {
 		commit_parameters(snum);
@@ -931,10 +1039,6 @@ static void shares_page(void)
 		}
 	}
 
-	printf("<FORM name=\"swatform\" method=post>\n");
-
-	printf("<table>\n");
-
 	if ( cgi_variable("ViewMode") )
 		mode = atoi(cgi_variable_nonull("ViewMode"));
 	if ( cgi_variable("BasicMode"))
@@ -942,6 +1046,12 @@ static void shares_page(void)
 	if ( cgi_variable("AdvMode"))
 		mode = 1;
 
+output_page:
+	printf("<FORM name=\"swatform\" method=post>\n");
+	print_xsrf_token(cgi_user_name(), cgi_user_pass(), form_name);
+
+	printf("<table>\n");
+
 	ViewModeBoxes( mode );
 	switch ( mode ) {
 		case 0:
@@ -1121,11 +1231,9 @@ static void chg_passwd(void)
 	if(cgi_variable(CHG_S_PASSWD_FLAG)) {
 		printf("<p>");
 		if (rslt == True) {
-			printf(_(" The passwd for '%s' has been changed."), cgi_variable_nonull(SWAT_USER));
-			printf("\n");
+			printf("%s\n", _(" The passwd has been changed."));
 		} else {
-			printf(_(" The passwd for '%s' has NOT been changed."), cgi_variable_nonull(SWAT_USER));
-			printf("\n");
+			printf("%s\n", _(" The passwd has NOT been changed."));
 		}
 	}
 	
@@ -1138,20 +1246,15 @@ static void chg_passwd(void)
 static void passwd_page(void)
 {
 	const char *new_name = cgi_user_name();
-
-	/* 
-	 * After the first time through here be nice. If the user
-	 * changed the User box text to another users name, remember it.
-	 */
-	if (cgi_variable(SWAT_USER)) {
-		new_name = cgi_variable_nonull(SWAT_USER);
-	} 
+	const char passwd_form[] = "passwd";
+	const char rpasswd_form[] = "rpasswd";
 
 	if (!new_name) new_name = "";
 
 	printf("<H2>%s</H2>\n", _("Server Password Management"));
 
 	printf("<FORM name=\"swatform\" method=post>\n");
+	print_xsrf_token(cgi_user_name(), cgi_user_pass(), passwd_form);
 
 	printf("<table>\n");
 
@@ -1191,14 +1294,16 @@ static void passwd_page(void)
 	 * Do some work if change, add, disable or enable was
 	 * requested. It could be this is the first time through this
 	 * code, so there isn't anything to do.  */
-	if ((cgi_variable(CHG_S_PASSWD_FLAG)) || (cgi_variable(ADD_USER_FLAG)) || (cgi_variable(DELETE_USER_FLAG)) ||
-	    (cgi_variable(DISABLE_USER_FLAG)) || (cgi_variable(ENABLE_USER_FLAG))) {
+	if (verify_xsrf_token(passwd_form) &&
+	   ((cgi_variable(CHG_S_PASSWD_FLAG)) || (cgi_variable(ADD_USER_FLAG)) || (cgi_variable(DELETE_USER_FLAG)) ||
+	    (cgi_variable(DISABLE_USER_FLAG)) || (cgi_variable(ENABLE_USER_FLAG)))) {
 		chg_passwd();		
 	}
 
 	printf("<H2>%s</H2>\n", _("Client/Server Password Management"));
 
 	printf("<FORM name=\"swatform\" method=post>\n");
+	print_xsrf_token(cgi_user_name(), cgi_user_pass(), rpasswd_form);
 
 	printf("<table>\n");
 
@@ -1231,7 +1336,7 @@ static void passwd_page(void)
 	 * password somewhere other than the server. It could be this
 	 * is the first time through this code, so there isn't
 	 * anything to do.  */
-	if (cgi_variable(CHG_R_PASSWD_FLAG)) {
+	if (verify_xsrf_token(passwd_form) && cgi_variable(CHG_R_PASSWD_FLAG)) {
 		chg_passwd();		
 	}
 
@@ -1248,18 +1353,15 @@ static void printers_page(void)
 	int i;
 	int mode = 0;
 	unsigned int parm_filter = FLAG_BASIC;
+	const char form_name[] = "printers";
+
+	if (!verify_xsrf_token(form_name)) {
+		goto output_page;
+	}
 
 	if (share)
 		snum = lp_servicenumber(share);
 
-        printf("<H2>%s</H2>\n", _("Printer Parameters"));
- 
-        printf("<H3>%s</H3>\n", _("Important Note:"));
-        printf("%s",_("Printer names marked with [*] in the Choose Printer drop-down box "));
-        printf("%s",_("are autoloaded printers from "));
-        printf("<A HREF=\"/swat/help/smb.conf.5.html#printcapname\" target=\"docs\">%s</A>\n", _("Printcap Name"));


-- 
Samba Shared Repository


More information about the samba-cvs mailing list