made CSRF token work

1 files changed, 6 insertions, 2 deletions

diff --git a/src/user.cpp b/src/user.cpp
index c77381d..07312f9 100644
--- a/src/user.cpp
+++ b/src/user.cpp
@@ -23,14 +23,18 @@ void user::login( )
 {
 	content::user c( cms );
 	ini( c );
-	if( request( ).request_method( ) == "POST" ) {
+	if( request( ).request_method( ) == "POST" && session( ).is_set( "prelogin" ) ) {
 		c.login.load( context( ) ); 
 		if( c.login.validate( ) ) {
-			response( ).set_redirect_header( cms.root( ) );
+			session( ).reset_session( );
+			session( ).erase( "prelogin" );
 			session( )["username"] = c.login.username.value( );
 			session( ).expose( "username" );
+			response( ).set_redirect_header( cms.root( ) );
 		}
 	}
+	
+	session( ).set( "prelogin", "" );  
 	render( "login", c );
 }