fixed potential vulnerability in form CRSF handling, thanks Anthony

2013-04-28 23:09:49 -05:00
parent 31e992696c
commit 681bc9755e
2 changed files with 2 additions and 2 deletions
@@ -1995,7 +1995,7 @@ class FORM(DIV):
        if session is not None:
            formkey = session.get('_formkey[%s]' % formname, None)
            # check if user tampering with form and void CSRF
-            if formkey != request_vars._formkey:
+            if not formkey or formkey != request_vars._formkey:
                status = False
        if formname != request_vars._formname:
            status = False