From 5a7e7e136776de145d7d6c78823e3bf7af5fd84c Mon Sep 17 00:00:00 2001
From: Andrew Dolgov <noreply@fakecake.org>
Date: Thu, 17 Sep 2020 10:20:55 +0300
Subject: [PATCH] don't try to call hash_equals() on unset user token

---
 include/functions.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/functions.php b/include/functions.php
index 298a77033..565a8fd41 100644
--- a/include/functions.php
+++ b/include/functions.php
@@ -679,7 +679,7 @@
 	}
 
 	function validate_csrf($csrf_token) {
-		return hash_equals($_SESSION['csrf_token'], $csrf_token);
+		return isset($csrf_token) && hash_equals($_SESSION['csrf_token'], $csrf_token);
 	}
 
 	function load_user_plugins($owner_uid, $pluginhost = false) {