From 7244bcda02978c855b93272c0d1437b6da3294ec Mon Sep 17 00:00:00 2001
From: wangyidong <yidong@cnezsoft.com>
Date: Tue, 19 Nov 2019 11:13:17 +0800
Subject: [PATCH]  * code for task #6510.

---
 config/zentaopms.php            | 1 +
 framework/base/router.class.php | 9 ++++++---
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/config/zentaopms.php b/config/zentaopms.php
index 83a093bf09..d047cf9d26 100644
--- a/config/zentaopms.php
+++ b/config/zentaopms.php
@@ -13,6 +13,7 @@
 /* Framework settings. */
 $config->framework->autoRepairTable = true;
 $config->framework->autoLang        = false;
+$config->framework->filterCSRF      = false;
 
 /* Upload settings. */
 $config->allowedTags = '<p><span><h1><h2><h3><h4><h5><em><u><strong><br><ol><ul><li><img><a><b><font><hr><pre><div><table><td><th><tr><tbody><embed><style>';
diff --git a/framework/base/router.class.php b/framework/base/router.class.php
index 69e28f09c3..30e89d121b 100644
--- a/framework/base/router.class.php
+++ b/framework/base/router.class.php
@@ -595,9 +595,12 @@ class baseRouter
         unset($_REQUEST);
 
         /* Change for CSRF. */
-        $httpType = (isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == 'on') ? 'https' : 'http';
-        $httpHost = $_SERVER['HTTP_HOST'];
-        if((!defined('RUN_MODE') or RUN_MODE != 'api') and strpos($this->server->http_referer, "$httpType://$httpHost") !== 0) $_FILES = $_POST = array();
+        if($this->config->framework->filterCSRF)
+        {
+            $httpType = (isset($_SERVER["HTTPS"]) && $_SERVER["HTTPS"] == 'on') ? 'https' : 'http';
+            $httpHost = $_SERVER['HTTP_HOST'];
+            if((!defined('RUN_MODE') or RUN_MODE != 'api') and strpos($this->server->http_referer, "$httpType://$httpHost") !== 0) $_FILES = $_POST = array();
+        }
 
         $_FILES  = validater::filterFiles();
         $_POST   = validater::filterSuper($_POST);