X-Git-Url: https://git.pterodactylus.net/?a=blobdiff_plain;f=src%2Fhttp%2Fpages%2Finsertedfilespage.cpp;h=e97bf6307f63311849ee2a27aa0bf1b15843c05e;hb=278ee758050cb7772cd95946688c5b40104f4d8b;hp=65cdeeabd46dfc70c433dc57268f930a4db47fdc;hpb=dec33c63afafabf83c3039e916725cac6faef9b3;p=fms.git

diff --git a/src/http/pages/insertedfilespage.cpp b/src/http/pages/insertedfilespage.cpp
index 65cdeea..e97bf63 100644
--- a/src/http/pages/insertedfilespage.cpp
+++ b/src/http/pages/insertedfilespage.cpp
@@ -16,7 +16,7 @@ const std::string InsertedFilesPage::GeneratePage(const std::string &method, con
 	Option::Instance()->Get("FProxyPort",fproxyport);
 
 
-	if(queryvars.find("formaction")!=queryvars.end() && (*queryvars.find("formaction")).second=="removefile" && queryvars.find("fileid")!=queryvars.end())
+	if(queryvars.find("formaction")!=queryvars.end() && (*queryvars.find("formaction")).second=="removefile" && queryvars.find("fileid")!=queryvars.end() && ValidateFormPassword(queryvars))
 	{
 		SQLite3DB::Statement del=m_db->Prepare("DELETE FROM tblFileInserts WHERE FileInsertID=?;");
 		del.Bind(0,(*queryvars.find("fileid")).second);
@@ -40,6 +40,7 @@ const std::string InsertedFilesPage::GeneratePage(const std::string &method, con
 
 		content+="<a href=\"http://"+node+":"+fproxyport+"/"+StringFunctions::UriEncode(key)+"\">"+SanitizeOutput(filename)+"</a> - "+sizestr+" bytes";
 		content+="<form name=\"frmRemove"+insertidstr+"\" method=\"POST\">";
+		content+=CreateFormPassword();
 		content+="<input type=\"hidden\" name=\"formaction\" value=\"removefile\">";
 		content+="<input type=\"hidden\" name=\"fileid\" value=\""+insertidstr+"\">";
 		content+="<input type=\"submit\" value=\"Remove\">";