From cedd87763b596e69de9c2782ec0ade6ecb6b583d Mon Sep 17 00:00:00 2001
From: Franco Fichtner <franco@opnsense.org>
Date: Tue, 9 Apr 2019 08:11:46 +0200
Subject: [PATCH] dashboard: only accept post from dashboard

Login form resubmit would not login but rather post to dashboard
which leaves all settings empty.

PR: https://forum.opnsense.org/index.php?topic=12328.0
---
 src/www/index.php | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/www/index.php b/src/www/index.php
index a0f56270e..43444d5cd 100644
--- a/src/www/index.php
+++ b/src/www/index.php
@@ -70,7 +70,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'GET') {
     usort($widgetCollection, function ($item1, $item2) {
       return strcmp(strtolower($item1['sortKey']), strtolower($item2['sortKey']));
     });
-} elseif ($_SERVER['REQUEST_METHOD'] === 'POST') {
+} elseif ($_SERVER['REQUEST_METHOD'] === 'POST' && !empty($_POST['origin']) && $_POST['origin'] == 'dashboard') {
     if (!empty($_POST['sequence'])) {
         $config['widgets']['sequence'] = $_POST['sequence'];
     } elseif (isset($config['widgets']['sequence'])) {
@@ -322,6 +322,7 @@ include("fbegin.inc");?>
 
 <section class="page-content-main">
   <form method="post" id="iform">
+    <input type="hidden" value="dasboard" name="origin" id="origin" />
     <input type="hidden" value="" name="sequence" id="sequence" />
     <input type="hidden" value="<?= $pconfig['column_count'];?>" name="column_count" id="column_count_input" />
   </form>