gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2025-02-11 17:44:56 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

- added form key

Browse Source
This commit is contained in:
steinm 2012-09-11 13:15:59 +00:00
parent 021529d02d
commit 4a67f259bf
2 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
op/op.ReviewDocument.php
View File

@ -26,6 +26,11 @@ include("../inc/inc.Language.php");
include("../inc/inc.ClassUI.php"); include("../inc/inc.ClassUI.php");
include("../inc/inc.Authentication.php"); include("../inc/inc.Authentication.php");
/* Check if the form data comes for a trusted request */
if(!checkFormKey('reviewdocument')) {
UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_request_token"))),getMLText("invalid_request_token"));
}
if (!isset($_POST["documentid"]) || !is_numeric($_POST["documentid"]) || intval($_POST["documentid"])<1) { if (!isset($_POST["documentid"]) || !is_numeric($_POST["documentid"]) || intval($_POST["documentid"])<1) {
UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id")); UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id"));
} }

3
out/out.ReviewDocument.php
View File

@ -132,7 +132,8 @@ if ($reviewStatus['type'] == 0) {
print "</tr></tbody></table><br>"; print "</tr></tbody></table><br>";
} }
?> ?>
<form method="POST" action="../op/op.ReviewDocument.php" name="form1" onsubmit="return checkIndForm();"> <form method="post" action="../op/op.ReviewDocument.php" name="form1" onsubmit="return checkIndForm();">
<?php echo createHiddenFieldWithKey('reviewdocument'); ?>
<table> <table>
<tr><td class='infos' valign='top'><?php printMLText("comment")?>:</td> <tr><td class='infos' valign='top'><?php printMLText("comment")?>:</td>
<td class='infos' valign='top'><textarea name="comment" cols="80" rows="4"></textarea> <td class='infos' valign='top'><textarea name="comment" cols="80" rows="4"></textarea>