gnh1201/seeddms-code
1
0
Fork 0
mirror of https://git.code.sf.net/p/seeddms/code synced 2024-11-26 15:32:13 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

add csrf protection

Browse Source
This commit is contained in:
Uwe Steinmann 2021-01-25 10:00:20 +01:00
parent b5d769fc1c
commit dc3cd2e1de
2 changed files with 6 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
op/op.SetExpires.php
View File

@ -28,6 +28,11 @@ include("../inc/inc.DBInit.php");
include("../inc/inc.ClassUI.php");
include("../inc/inc.Authentication.php");
/* Check if the form data comes from a trusted request */
if(!checkFormKey('setexpires')) {
UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_request_token"))),getMLText("invalid_request_token"));
}
if (!isset($_POST["documentid"]) || !is_numeric($_POST["documentid"]) || intval($_POST["documentid"])<1) {
UI::exitError(getMLText("document_title", array("documentname" => getMLText("invalid_doc_id"))),getMLText("invalid_doc_id"));
}

1
views/bootstrap/class.SetExpires.php
View File

@ -66,6 +66,7 @@ $(document).ready( function() {
<form class="form-horizontal" action="../op/op.SetExpires.php" method="post">
<input type="hidden" name="documentid" value="<?php print $document->getID();?>">
<?php echo createHiddenFieldWithKey('setexpires'); ?>
<?php
$options = array();
$options[] = array('never', getMLText('does_not_expire'));