Using http status 403 for invalid csrf token

nahcikuy · Oct 6, 2019 · 35be36c · 35be36c
1 parent 05672db
commit 35be36c
Showing 1 changed file with 12 additions and 13 deletions.
diff --git a/trunk/web/include/csrf_check.php b/trunk/web/include/csrf_check.php
@@ -1,15 +1,14 @@
 <?php
-  @session_start();
-  if( $_SERVER['REQUEST_METHOD']=='POST'  ){
-	if (isset($_SESSION[$OJ_NAME.'_'.'csrf_keys'])
-   		&& is_array($_SESSION[$OJ_NAME.'_'.'csrf_keys'])
-		&& isset($_POST['csrf'])
-   		&& in_array($_POST['csrf'],$_SESSION[$OJ_NAME.'_'.'csrf_keys'])
-   	){
-//		echo "<!-csrf check passed->";
-  	}else{	
-		echo "<!-csrf check failed->";
-		exit(1);
+  	@session_start();
+  	if( $_SERVER['REQUEST_METHOD'] == 'POST'){
+	  	if( !isset($_SESSION[$OJ_NAME.'_'.'csrf_keys'])
+			|| !is_array($_SESSION[$OJ_NAME.'_'.'csrf_keys'])
+	  		|| !isset($_POST['csrf'])
+			|| !in_array($_POST['csrf'], $_SESSION[$OJ_NAME.'_'.'csrf_keys'])
+		){
+		  	http_response_code(403);
+		  	echo "Invalid csrf token";
+		  	exit;
+		}
   	}
-  }
-?>
+?>