= $_SESSION['POLICY_CSRF_STRICTNESS']) { return true; }else{ echo "

Potential use CSRF detected

\n". "

Please disable any plugins/add-ons inside your browser or contact your system administrator. If you are the system administrator you can run v-change-sys-config-value 'POLICY_CSRF_STRICTNESS' '0' as root to disable this check.

". "

If you folowed a bookmark or an static link please click here"; die(); } } function prevent_post_csrf(){ if ($_SERVER['REQUEST_METHOD']=='POST') { $hostname = explode( ':', $_SERVER['HTTP_HOST']); $port=$hostname[1]; $hostname=$hostname[0]; if (strpos($_SERVER['HTTP_ORIGIN'],gethostname()) !== false && in_array($port, array('443',$_SERVER['SERVER_PORT'])) ) { return checkStrictness(2); }else{ if (strpos($_SERVER['HTTP_ORIGIN'],$hostname) !== false && in_array($port, array('443',$_SERVER['SERVER_PORT'])) ){ return checkStrictness(1); } else { return checkStrictness(0); } } } } function prevent_get_csrf(){ if ($_SERVER['REQUEST_METHOD']=='GET') { $hostname = explode( ':', $_SERVER['HTTP_HOST']); $port=$hostname[1]; $hostname=$hostname[0]; //list of possible entries route and these should never be blocked if (in_array($_SERVER['DOCUMENT_URI'], array('/list/user/index.php', '/login/index.php','/list/web/index.php','/list/dns/index.php','/list/mail/index.php','/list/db/index.php','/list/cron/index.php','/list/backup/index.php','/reset/index.php'))){ return true; } if (strpos($_SERVER['HTTP_REFERER'],gethostname()) !== false && in_array($port, array('443',$_SERVER['SERVER_PORT'])) ) { return checkStrictness(2); }else{ if (strpos($_SERVER['HTTP_REFERER'],$hostname) !== false && in_array($port, array('443',$_SERVER['SERVER_PORT'])) ){ return checkStrictness(1); } else { return checkStrictness(0); } } } } if ( $check_csrf == true){ prevent_post_csrf(); prevent_get_csrf(); }