diff --git a/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration.jst b/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration.jst index 8c97792..1403a2e 100644 --- a/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration.jst +++ b/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration.jst @@ -59,8 +59,9 @@ function validFilterParam($ft){ } if ($_POST['configInfo']) { $jsConfig = $_POST['configInfo']; -} else if ($_GET['configInfo']){ - $jsConfig = rawurldecode($_GET['configInfo']); +} else { + echo('{"error":"configInfo parameter required"}'); + exit(0); } //$jsConfig = '{"ssid_number":"1", "ft":[["1","2"],["c","d"]], "target":"save_filter"}'; $arConfig = json_decode($jsConfig, true); diff --git a/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration_onewifi.jst b/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration_onewifi.jst index f19ccf4..a283cec 100644 --- a/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration_onewifi.jst +++ b/source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration_onewifi.jst @@ -68,8 +68,9 @@ function validFilterParam($ft){ } if ($_POST['configInfo']) { $jsConfig = $_POST['configInfo']; -} else if ($_GET['configInfo']){ - $jsConfig = rawurldecode($_GET['configInfo']); +} else { + echo('{"error":"configInfo parameter required"}'); + exit(0); } //$jsConfig = '{"ssid_number":"1", "ft":[["1","2"],["c","d"]], "target":"save_filter"}'; diff --git a/tests/ajaxSet_wireless_csrf_test.sh b/tests/ajaxSet_wireless_csrf_test.sh new file mode 100644 index 0000000..4c5ef91 --- /dev/null +++ b/tests/ajaxSet_wireless_csrf_test.sh @@ -0,0 +1,10 @@ +#!/bin/sh +if grep -q "\$_GET\['configInfo'\]" source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration.jst; then + echo "FAIL: GET support still present in ajaxSet_wireless_network_configuration.jst" + exit 1 +fi +if grep -q "\$_GET\['configInfo'\]" source/Styles/xb6/jst/actionHandler/ajaxSet_wireless_network_configuration_onewifi.jst; then + echo "FAIL: GET support still present in ajaxSet_wireless_network_configuration_onewifi.jst" + exit 1 +fi +echo "PASS: GET support removed from both files"