From 276d9e6974822db4ad1e6639271b0e97b17445f5 Mon Sep 17 00:00:00 2001
From: John Reese <jreese@leetcode.net>
Date: Fri, 27 Mar 2009 14:16:51 -0400
Subject: [PATCH] Fix #9999: allow form security to be disabled for sites that use 'bad' proxy servers.

---
 config_defaults_inc.php |   10 +++++++++-
 core/form_api.php       |   20 ++++++++++++++++++++
 2 files changed, 29 insertions(+), 1 deletions(-)

diff --git a/config_defaults_inc.php b/config_defaults_inc.php
index d551adc..bf372eb 100644
--- a/config_defaults_inc.php
+++ b/config_defaults_inc.php
@@ -230,6 +230,14 @@
 	 */
 	$g_session_validation = ON;
 
+	/**
+	 * Form security validation.
+	 * This protects against Cross-Site Request Forgery, but some proxy servers may
+	 * not correctly work with this option enabled because they cache pages incorrectly.
+	 * WARNING: Disabling this IS a security risk!!
+	 */
+	$g_form_security_validation = ON;
+
 	/**************************
 	 * Configuration Settings *
 	 **************************/
@@ -243,7 +251,7 @@
 	$g_global_settings = array(
 		'_table$', 'cookie', '^db_', 'hostname', 'allow_signup', 'database_name', 'show_queries_count', 'admin_checks', 'version_suffix',
 		'_path$', 'use_iis', 'language', 'use_javascript', 'display_errors', 'show_detailed_errors', 'stop_on_errors', 'login_method', '_file$',
-		'anonymous', 'content_expire', 'html_valid_tags', 'custom_headers', 'rss_key_seed', 'plugins_enabled', 'session_',
+		'anonymous', 'content_expire', 'html_valid_tags', 'custom_headers', 'rss_key_seed', 'plugins_enabled', 'session_', 'form_security_',
 	);
 
 	/****************************
diff --git a/core/form_api.php b/core/form_api.php
index 776d6bd..31dc5b9 100644
--- a/core/form_api.php
+++ b/core/form_api.php
@@ -36,6 +36,10 @@
  * @return string Security token string
  */
 function form_security_token( $p_form_name ) {
+	if ( OFF == config_get_global( 'form_security_validation' ) ) {
+		return;
+	}
+
 	$t_tokens = session_get( 'form_security_tokens', array() );
 
 	# Create a new array for the form name if necessary
@@ -62,6 +66,10 @@ function form_security_token( $p_form_name ) {
  * @return string Hidden form element to output
  */
 function form_security_field( $p_form_name ) {
+	if ( OFF == config_get_global( 'form_security_validation' ) ) {
+		return '';
+	}
+
 	$t_string = form_security_token( $p_form_name );
 
 	# Create the form element HTML string for the security token
@@ -78,6 +86,10 @@ function form_security_field( $p_form_name ) {
  * @return string Hidden form element to output
  */
 function form_security_param( $p_form_name ) {
+	if ( OFF == config_get_global( 'form_security_validation' ) ) {
+		return '';
+	}
+
 	$t_string = form_security_token( $p_form_name );
 
 	# Create the GET parameter to be used in a URL for a secure link
@@ -96,6 +108,10 @@ function form_security_param( $p_form_name ) {
  * @return boolean Form is valid
  */
 function form_security_validate( $p_form_name ) {
+	if ( OFF == config_get_global( 'form_security_validation' ) ) {
+		return;
+	}
+
 	$t_tokens = session_get( 'form_security_tokens', array() );
 
 	# Short-circuit if we don't have any tokens for the given form name
@@ -142,6 +158,10 @@ function form_security_validate( $p_form_name ) {
  * @param string Form name
  */
 function form_security_purge( $p_form_name ) {
+	if ( OFF == config_get_global( 'form_security_validation' ) ) {
+		return;
+	}
+
 	$t_tokens = session_get( 'form_security_tokens', array() );
 
 	# Short-circuit if we don't have any tokens for the given form name
-- 
1.6.1.2