관리자 CSRF 취약점 수정

2015-11-23 18:22:10 +09:00
parent 976c9d0f9b
commit 32d09cff7d
49 changed files with 179 additions and 62 deletions
--- a/adm/ajax.token.php
+++ b/adm/ajax.token.php
@ -0,0 +1,14 @@
+<?php
+include_once('./_common.php');
+include_once(G5_LIB_PATH.'/json.lib.php');
+
+set_session('ss_admin_token', '');
+
+$error = admin_referer_check(true);
+if($error)
+    die(json_encode(array('error'=>$error, 'url'=>G5_URL)));
+
+$token = get_admin_token();
+
+die(json_encode(array('error'=>'', 'token'=>$token, 'url'=>'')));
+?>