don't try to call hash_equals() on unset user token

4 years ago · 5a7e7e1367
parent f72e6947d5
commit 5a7e7e1367
1 changed files with 1 additions and 1 deletions
--- a/include/functions.php
+++ b/include/functions.php
@ -679,7 +679,7 @@
 	}

 	function validate_csrf($csrf_token) {
-		return hash_equals($_SESSION['csrf_token'], $csrf_token);
+		return isset($csrf_token) && hash_equals($_SESSION['csrf_token'], $csrf_token);
 	}

 	function load_user_plugins($owner_uid, $pluginhost = false) {