editpage: factor out checksessionexpiry into IkiWiki::CGI

[ikiwiki.git] / IkiWiki / CGI.pm

diff --git a/IkiWiki/CGI.pm b/IkiWiki/CGI.pm
index 4399d0dcbba5a8726f57a76d8e36ac3e42107341..a3486cbb40034cafc2fcdedd32c828626261339d 100644 (file)
--- a/IkiWiki/CGI.pm
+++ b/IkiWiki/CGI.pm
@@ -296,6 +296,20 @@ sub cgi_getsession ($) { #{{{
        return $session;
 } #}}}
 
        return $session;
 } #}}}
 

+# The session id is stored on the form and checked to
+# guard against CSRF. But only if the user is logged in,
+# as anonok can allow anonymous edits.
+sub checksessionexpiry ($$) { # {{{
+       my $session = shift;
+       my $sid = shift;
+
+       if (defined $session->param("name")) {
+               if (! defined $sid || $sid ne $session->id) {
+                       error(gettext("Your login session has expired."));
+               }
+       }
+} # }}}
+

 sub cgi_savesession ($) { #{{{
        my $session=shift;
 
 sub cgi_savesession ($) { #{{{
        my $session=shift;