CSRF token in Geo My WP form
-
Hello.
We run a Detectify.com scan on our site, and their scan detected that the search form used for geo-my-wp doesn’t use a CSRF token to verify the payload of the form.
<form id="gmw-cl-hidden-form" method="post"> <input type="hidden" id="gmw-cl-street" name="gmw_cl_location[street]" value=""> <input type="hidden" id="gmw-cl-city" name="gmw_cl_location[city]" value=""> <input type="hidden" id="gmw-cl-state" name="gmw_cl_location[state]" value=""> <input type="hidden" id="gmw-cl-state-long" name="gmw_cl_location[state_long]" value=""> <input type="hidden" id="gmw-cl-zipcode" name="gmw_cl_location[zipcode]" value=""> <input type="hidden" id="gmw-cl-country" name="gmw_cl_location[country]" value=""> <input type="hidden" id="gmw-cl-country-long" name="gmw_cl_location[country_long]" value=""> <input type="hidden" id="gmw-cl-org-address" name="gmw_cl_location[address]" value=""> <input type="hidden" id="gmw-cl-formatted-address" name="gmw_cl_location[formatted_address]" value=""> <input type="hidden" id="gmw-cl-lat" name="gmw_cl_location[lat]" value=""> <input type="hidden" id="gmw-cl-lng" name="gmw_cl_location[lng]" value=""> <input type="hidden" id="gmw-cl-action" name="gmw_cl_action" value="post"> </form>
Do you have any plans to implement CSRF/XSRF protections in the plugin anytime soon?
- The topic ‘CSRF token in Geo My WP form’ is closed to new replies.