= $_SESSION['POLICY_CSRF_STRICTNESS']) { return true; } else { http_response_code(400); echo "
Please disable any plugins/add-ons inside your browser or contact your system administrator. If you are the system administrator you can run v-change-sys-config-value 'POLICY_CSRF_STRICTNESS' '0' as root to disable this check.
". "
If you folowed a bookmark or an static link please click here"; die(); } } function prevent_post_csrf() { if ($_SERVER['REQUEST_METHOD']==='POST') { $hostname = explode(':', $_SERVER['HTTP_HOST']); $port=$hostname[1]; $hostname=$hostname[0]; if (strpos($_SERVER['HTTP_ORIGIN'], gethostname()) !== false && in_array($port, array('443',$_SERVER['SERVER_PORT']))) { return checkStrictness(2); } else { if (strpos($_SERVER['HTTP_ORIGIN'], $hostname) !== false && in_array($port, array('443',$_SERVER['SERVER_PORT']))) { return checkStrictness(1); } else { return checkStrictness(0); } } } } function prevent_get_csrf() { if ($_SERVER['REQUEST_METHOD']==='GET') { $hostname = explode(':', $_SERVER['HTTP_HOST']); $port=$hostname[1]; $hostname=$hostname[0]; //list of possible entries route and these should never be blocked if (in_array($_SERVER['DOCUMENT_URI'], array('/list/user/index.php', '/login/index.php','/list/web/index.php','/list/dns/index.php','/list/mail/index.php','/list/db/index.php','/list/cron/index.php','/list/backup/index.php','/reset/index.php'))) { return true; } if (strpos($_SERVER['HTTP_REFERER'], gethostname()) !== false && in_array($port, array('443',$_SERVER['SERVER_PORT']))) { return checkStrictness(2); } else { if (strpos($_SERVER['HTTP_REFERER'], $hostname) !== false && in_array($port, array('443',$_SERVER['SERVER_PORT']))) { return checkStrictness(1); } else { return checkStrictness(0); } } } } if ($check_csrf == true) { prevent_post_csrf(); prevent_get_csrf(); }