From 0a255e8b499d0e725dc6a4ed3594698b6a22d4dc Mon Sep 17 00:00:00 2001
From: glaszig <glaszig@gmail.com>
Date: Thu, 1 Aug 2019 13:03:59 +0200
Subject: [PATCH] don't write the csrf token field to the output buffer but
 return and echo it

---
 includes/admin.php            | 2 +-
 includes/configure_client.php | 2 +-
 includes/functions.php        | 2 +-
 includes/hostapd.php          | 2 +-
 includes/system.php           | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/includes/admin.php b/includes/admin.php
index 22353461..f867705c 100755
--- a/includes/admin.php
+++ b/includes/admin.php
@@ -40,7 +40,7 @@ function DisplayAuthConfig($username, $password)
         <div class="panel-body">
           <p><?php $status->showMessages(); ?></p>
           <form role="form" action="?page=auth_conf" method="POST">
-            <?php CSRFToken() ?>
+            <?php echo CSRFToken() ?>
             <div class="row">
               <div class="form-group col-md-4">
                 <label for="username"><?php echo _("Username"); ?></label>
diff --git a/includes/configure_client.php b/includes/configure_client.php
index d1640041..458676ac 100755
--- a/includes/configure_client.php
+++ b/includes/configure_client.php
@@ -182,7 +182,7 @@ function DisplayWPAConfig()
             </div> 
 
             <form method="POST" action="?page=wpa_conf" name="wpa_conf_form">
-                <?php CSRFToken() ?>
+                <?php echo CSRFToken() ?>
               <input type="hidden" name="client_settings" ?>
               <script>
                 function showPassword(index) {
diff --git a/includes/functions.php b/includes/functions.php
index b3b8f996..94423d43 100755
--- a/includes/functions.php
+++ b/includes/functions.php
@@ -70,7 +70,7 @@ function ensureCSRFSessionToken()
 function CSRFToken()
 {
     $token = htmlspecialchars($_SESSION['csrf_token']);
-    echo '<input id="csrf_token" type="hidden" name="csrf_token" value="' . $token . '">';
+    return '<input id="csrf_token" type="hidden" name="csrf_token" value="' . $token . '">';
 }
 
 /**
diff --git a/includes/hostapd.php b/includes/hostapd.php
index 0da1c795..7a192a68 100755
--- a/includes/hostapd.php
+++ b/includes/hostapd.php
@@ -83,7 +83,7 @@ function DisplayHostAPDConfig()
                 <div class="tab-pane fade in active" id="basic">
 
                 <h4><?php echo _("Basic settings") ;?></h4>
-                <?php CSRFToken() ?>
+                <?php echo CSRFToken() ?>
                 <div class="row">
                   <div class="form-group col-md-4">
                     <label for="cbxinterface"><?php echo _("Interface") ;?></label>
diff --git a/includes/system.php b/includes/system.php
index 746963c9..f1ac44db 100755
--- a/includes/system.php
+++ b/includes/system.php
@@ -200,7 +200,7 @@ if (isset($_POST['system_shutdown'])) {
 
     <div role="tabpanel" class="tab-pane" id="language">
       <h4><?php echo _("Language settings") ;?></h4>
-        <?php CSRFToken() ?>
+        <?php echo CSRFToken() ?>
       <div class="row">
         <div class="form-group col-md-4">
           <label for="code"><?php echo _("Select a language"); ?></label>