version 0.3.13

[fms.git] / src / http / pages / localidentitiespage.cpp

diff --git a/src/http/pages/localidentitiespage.cpp b/src/http/pages/localidentitiespage.cpp
index 5fa76b5..d4e0d44 100644 (file)
--- a/src/http/pages/localidentitiespage.cpp
+++ b/src/http/pages/localidentitiespage.cpp
@@ -18,11 +18,13 @@ const std::string LocalIdentitiesPage::GeneratePage(const std::string &method, c
        content+="<table><tr><th>Export Identities</th><th>Import Identities</th></tr>";\r
        content+="<tr><td>";\r
        content+="<form name=\"frmexport\" method=\"POST\">";\r
+       content+=CreateFormPassword();\r
        content+="<input type=\"hidden\" name=\"formaction\" value=\"export\">";\r
        content+="<input type=\"submit\" value=\"Export Identities\">";\r
        content+="</form>";\r
        content+="</td><td>";\r
        content+="<form name=\"frmimport\" method=\"POST\" enctype=\"multipart/form-data\">";\r
+       content+=CreateFormPassword();\r
        content+="<input type=\"hidden\" name=\"formaction\" value=\"import\">";\r
        content+="<input type=\"file\" name=\"file\">";\r
        content+="<input type=\"submit\" value=\"Import Identities\">";\r
@@ -63,7 +65,7 @@ const std::string LocalIdentitiesPage::GeneratePage(const std::string &method, c
                st.ResultText(9,maxmessagedelay);\r
 \r
                content+="<tr>";\r
-               content+="<td title=\""+publickey+"\"><form name=\"frmupdate\""+countstr+"\" method=\"POST\"><input type=\"hidden\" name=\"formaction\" value=\"update\"><input type=\"hidden\" name=\"chkidentityid["+countstr+"]\" value=\""+id+"\">"+SanitizeOutput(CreateShortIdentityName(name,publickey))+"</td>";\r
+               content+="<td title=\""+publickey+"\"><form name=\"frmupdate\""+countstr+"\" method=\"POST\"><input type=\"hidden\" name=\"formaction\" value=\"update\">"+CreateFormPassword()+"<input type=\"hidden\" name=\"chkidentityid["+countstr+"]\" value=\""+id+"\">"+SanitizeOutput(CreateShortIdentityName(name,publickey))+"</td>";\r
                content+="<td>"+CreateTrueFalseDropDown("singleuse["+countstr+"]",singleuse)+"</td>";\r
                content+="<td>"+CreateTrueFalseDropDown("publishtrustlist["+countstr+"]",publishtrustlist)+"</td>";\r
                content+="<td>"+CreateTrueFalseDropDown("publishboardlist["+countstr+"]",publishboardlist)+"</td>";\r
@@ -86,7 +88,7 @@ const std::string LocalIdentitiesPage::GeneratePage(const std::string &method, c
                trustst.Reset();\r
 \r
                content+="<td><input type=\"submit\" value=\"Update\"></form></td>";\r
-               content+="<td><form name=\"frmdel\""+countstr+"\" method=\"POST\" action=\"confirm.htm\"><input type=\"hidden\" name=\"formaction\" value=\"delete\"><input type=\"hidden\" name=\"chkidentityid["+countstr+"]\" value=\""+id+"\"><input type=\"hidden\" name=\"targetpage\" value=\"localidentities.htm\"><input type=\"hidden\" name=\"confirmdescription\" value=\"Are you sure you want to delete "+SanitizeOutput(CreateShortIdentityName(name,publickey))+"?\"><input type=\"submit\" value=\"Delete\"></form></td>";\r
+               content+="<td><form name=\"frmdel\""+countstr+"\" method=\"POST\" action=\"confirm.htm\">"+CreateFormPassword()+"<input type=\"hidden\" name=\"formaction\" value=\"delete\"><input type=\"hidden\" name=\"chkidentityid["+countstr+"]\" value=\""+id+"\"><input type=\"hidden\" name=\"targetpage\" value=\"localidentities.htm\"><input type=\"hidden\" name=\"confirmdescription\" value=\"Are you sure you want to delete "+SanitizeOutput(CreateShortIdentityName(name,publickey))+"?\"><input type=\"submit\" value=\"Delete\"></form></td>";\r
                content+="</tr>";\r
                content+="<tr><td></td><td colspan=\"7\" class=\"smaller\">"+publickey+"</td></tr>";\r
                st.Step();\r
@@ -232,7 +234,7 @@ void LocalIdentitiesPage::handleRequest(Poco::Net::HTTPServerRequest &request, P
        CreateQueryVarMap(request,vars);\r
 \r
        std::string formaction="";\r
-       if(vars.find("formaction")!=vars.end())\r
+       if(vars.find("formaction")!=vars.end() && ValidateFormPassword(vars))\r
        {\r
                formaction=(*vars.find("formaction")).second;\r
                if(formaction=="update")\r