Refs #3733 Installer was broken because there is not yet a token_auth…

… during installer, disabling csrf protectionif piwik is not installed
matomo-org · Feb 7, 2013 · c8f11dd · c8f11dd
1 parent 8ac1bc2
commit c8f11dd
Show file tree

Hide file tree

Showing 4 changed files with 11 additions and 3 deletions.
diff --git a/plugins/Installation/templates/finished.tpl b/plugins/Installation/templates/finished.tpl
@@ -4,5 +4,5 @@
 
 
 <p class="nextStep">
-	<a href="index.php">{'Installation_ContinueToPiwik'|translate} &raquo;</a>
+	<a class="submit" href="index.php">{'Installation_ContinueToPiwik'|translate} &raquo;</a>
 </p>
diff --git a/plugins/Installation/templates/install.css b/plugins/Installation/templates/install.css
@@ -48,6 +48,9 @@ h3 {
 	line-height:1.33;
 }
 
+#topRightBar {
+    float:right;top:-60px; right:10px;position:relative;
+}
 .error {
 	color:red;
 	font-size:100%;

diff --git a/plugins/LanguagesManager/Controller.php b/plugins/LanguagesManager/Controller.php
@@ -22,7 +22,11 @@ class Piwik_LanguagesManager_Controller extends Piwik_Controller
 	public function saveLanguage()
 	{
 		$language = Piwik_Common::getRequestVar('language');
-		$this->checkTokenInUrl();
+
+		// Prevent CSRF only when piwik is not installed yet (During install user can change language)
+		if(Piwik::isInstalled()) {
+			$this->checkTokenInUrl();
+		}
 		Piwik_LanguagesManager::setLanguageForSession($language);
 		if(Zend_Registry::isRegistered('access')) {
 			$currentUser = Piwik::getCurrentUserLogin();

diff --git a/plugins/LanguagesManager/templates/languages.tpl b/plugins/LanguagesManager/templates/languages.tpl
@@ -7,7 +7,8 @@
 			<option value="{$language.code}" {if $language.code == $currentLanguageCode}selected="selected"{/if} title="{$language.name} ({$language.english_name})">{$language.name}</option>
 			{/foreach}
 		</select>
-		<input type="hidden" name="token_auth" value="{$token_auth}"/>
+		{* During installation token_auth is not set *}
+		{if !empty($token_auth)}<input type="hidden" name="token_auth" value="{$token_auth}"/>{/if}
 		<input type="submit" value="go" />
 		</form>
 	</span>