gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2025-05-15 14:11:35 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

add csrf protection

Browse Source
This commit is contained in:
Uwe Steinmann 2021-01-25 09:07:49 +01:00
parent c5694c21b4
commit 0638dab4f8
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
op/op.OverrideContentStatus.php
View File

@ -28,6 +28,11 @@ include("../inc/inc.DBInit.php");
include("../inc/inc.ClassUI.php"); include("../inc/inc.ClassUI.php");
include("../inc/inc.Authentication.php"); include("../inc/inc.Authentication.php");
/* Check if the form data comes from a trusted request */
if(!checkFormKey('overridecontentstatus')) {
UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_request_token"))),getMLText("invalid_request_token"));
}
if (!isset($_POST["documentid"]) || !is_numeric($_POST["documentid"]) || intval($_POST["documentid"])<1) { if (!isset($_POST["documentid"]) || !is_numeric($_POST["documentid"]) || intval($_POST["documentid"])<1) {
UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id")); UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id"));
} }

1
views/bootstrap/class.OverrideContentStatus.php
View File

@ -85,6 +85,7 @@ $(document).ready(function() {
// Display the Review form. // Display the Review form.
?> ?>
<form class="form-horizontal" method="post" action="../op/op.OverrideContentStatus.php" id="form1" name="form1"> <form class="form-horizontal" method="post" action="../op/op.OverrideContentStatus.php" id="form1" name="form1">
<?php echo createHiddenFieldWithKey('overridecontentstatus'); ?>
<input type='hidden' name='documentid' value='<?php echo $document->getID() ?>'/> <input type='hidden' name='documentid' value='<?php echo $document->getID() ?>'/>
<input type='hidden' name='version' value='<?php echo $content->getVersion() ?>'/> <input type='hidden' name='version' value='<?php echo $content->getVersion() ?>'/>
<?php <?php