diff -ruN perl-CGI-FormMagick-0.93.old/lib/CGI/FormMagick/Events.pm perl-CGI-FormMagick-0.93/lib/CGI/FormMagick/Events.pm --- perl-CGI-FormMagick-0.93.old/lib/CGI/FormMagick/Events.pm 2018-10-22 15:37:29.557795203 +0200 +++ perl-CGI-FormMagick-0.93/lib/CGI/FormMagick/Events.pm 2018-10-22 15:39:25.003464188 +0200 @@ -130,6 +130,11 @@ sub page_post_event { my ($self) = @_; $self->debug_msg("This is the page post-event."); + if ($self->{csrf} and ($self->{cgi}->request_method || 'POST') eq 'POST' and + ($self->{cgi}->param('csrf_token') || '') ne $self->{cgi}->param('csrf_token_compare')){ + warn "CSRF protection blocked request\n"; + return $self->error($self->localise('CSRF_VALIDATION_FAILURE')); + } if (my $post_page_routine = $self->page->{'post-event'}) { $self->debug_msg("The post-routine is $post_page_routine"); $self->do_external_routine($post_page_routine); diff -ruN perl-CGI-FormMagick-0.93.old/lib/CGI/FormMagick/HTML.pm perl-CGI-FormMagick-0.93/lib/CGI/FormMagick/HTML.pm --- perl-CGI-FormMagick-0.93.old/lib/CGI/FormMagick/HTML.pm 2018-10-22 15:37:29.574796035 +0200 +++ perl-CGI-FormMagick-0.93/lib/CGI/FormMagick/HTML.pm 2018-10-22 15:39:59.995182470 +0200 @@ -182,6 +182,9 @@ print qq( \n); print qq( \n); print " ",$fm->{cgi}->state_field(), "\n"; # hidden field with state ID + if ($fm->{cgi}->param('csrf_token_compare')){ + print " {cgi}->param('csrf_token_compare') . "\">\n"; + } print "