• Hello.

    We run a Detectify.com scan on our site, and their scan detected that the search form used for geo-my-wp doesn’t use a CSRF token to verify the payload of the form.

    <form id="gmw-cl-hidden-form" method="post">
    <input type="hidden" id="gmw-cl-street" name="gmw_cl_location[street]" value="">
    <input type="hidden" id="gmw-cl-city" name="gmw_cl_location[city]" value="">
    <input type="hidden" id="gmw-cl-state" name="gmw_cl_location[state]" value="">
    <input type="hidden" id="gmw-cl-state-long" name="gmw_cl_location[state_long]" value="">
    <input type="hidden" id="gmw-cl-zipcode" name="gmw_cl_location[zipcode]" value="">
    <input type="hidden" id="gmw-cl-country" name="gmw_cl_location[country]" value="">
    <input type="hidden" id="gmw-cl-country-long" name="gmw_cl_location[country_long]" value="">
    <input type="hidden" id="gmw-cl-org-address" name="gmw_cl_location[address]" value="">
    <input type="hidden" id="gmw-cl-formatted-address" name="gmw_cl_location[formatted_address]" value="">
    <input type="hidden" id="gmw-cl-lat" name="gmw_cl_location[lat]" value="">
    <input type="hidden" id="gmw-cl-lng" name="gmw_cl_location[lng]" value="">
    <input type="hidden" id="gmw-cl-action" name="gmw_cl_action" value="post">
    </form>

    Do you have any plans to implement CSRF/XSRF protections in the plugin anytime soon?

  • The topic ‘CSRF token in Geo My WP form’ is closed to new replies.