Digitalstack/myaac
2
0
Fork 0
mirror of https://github.com/slawkens/myaac.git synced 2025-10-14 01:34:55 +02:00
Code Issues Packages Projects Releases Wiki Activity

Protect against csrf in more places (accounts & guilds pages)

Browse Source
This commit is contained in:
slawkens
2025-05-24 09:52:56 +02:00
parent 72cdd290da
commit 6eda38603c
21 changed files with 43 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
system/pages/account/change-email.php
View File

@@ -17,6 +17,8 @@ if(!$logged) {
return;
}
csrfProtect();
$email_new_time = $account_logged->getCustomField("email_new_time");
if($email_new_time > 10) {

2
system/pages/account/change-info.php
View File

@@ -20,6 +20,8 @@ if(!$logged) {
return;
}
csrfProtect();
if(setting('core.account_country'))
require SYSTEM . 'countries.conf.php';

2
system/pages/account/change-password.php
View File

@@ -17,6 +17,8 @@ if(!$logged) {
return;
}
csrfProtect();
$new_password = $_POST['newpassword'] ?? NULL;
$new_password_confirm = $_POST['newpassword_confirm'] ?? NULL;
$old_password = $_POST['oldpassword'] ?? NULL;

2
system/pages/account/characters/change-comment.php
View File

@@ -20,6 +20,8 @@ if(!$logged) {
return;
}
csrfProtect();
$player = null;
$player_name = isset($_REQUEST['name']) ? stripslashes(urldecode($_REQUEST['name'])) : null;
$new_comment = isset($_POST['comment']) ? htmlspecialchars(stripslashes(substr($_POST['comment'],0,2000))) : NULL;

2
system/pages/account/characters/change-name.php
View File

@@ -17,6 +17,8 @@ if(!$logged) {
return;
}
csrfProtect();
$player_id = isset($_POST['player_id']) ? (int)$_POST['player_id'] : NULL;
$name = isset($_POST['name']) ? stripslashes(ucwords(strtolower($_POST['name']))) : NULL;
if((!setting('core.account_change_character_name')))

2
system/pages/account/characters/change-sex.php
View File

@@ -17,6 +17,8 @@ if(!$logged) {
return;
}
csrfProtect();
$sex_changed = false;
$player_id = isset($_POST['player_id']) ? (int)$_POST['player_id'] : NULL;
$new_sex = isset($_POST['new_sex']) ? (int)$_POST['new_sex'] : NULL;

2
system/pages/account/characters/create.php
View File

@@ -20,6 +20,8 @@ if(!$logged) {
return;
}
csrfProtect();
$character_name = isset($_POST['name']) ? stripslashes($_POST['name']) : null;
$character_sex = isset($_POST['sex']) ? (int)$_POST['sex'] : null;
$character_vocation = isset($_POST['vocation']) ? (int)$_POST['vocation'] : null;

2
system/pages/account/characters/delete.php
View File

@@ -17,6 +17,8 @@ if(!$logged) {
return;
}
csrfProtect();
$player_name = isset($_POST['delete_name']) ? stripslashes($_POST['delete_name']) : null;
$password_verify = isset($_POST['delete_password']) ? $_POST['delete_password'] : null;
$password_verify = encrypt((USE_ACCOUNT_SALT ? $account_logged->getCustomField('salt') : '') . $password_verify);

2
system/pages/account/create.php
View File

@@ -23,6 +23,8 @@ if($logged)
return;
}
csrfProtect();
if(setting('core.account_create_character_create')) {
$createCharacter = new CreateCharacter();
}

2
system/pages/account/login.php
View File

@@ -18,6 +18,8 @@ if($logged || !isset($_POST['account_login']) || !isset($_POST['password_login']
return;
}
csrfProtect();
$login_account = $_POST['account_login'];
$login_password = $_POST['password_login'];
$remember_me = isset($_POST['remember_me']);

2
system/pages/account/manage.php
View File

@@ -34,6 +34,8 @@ if(isset($_REQUEST['redirect']))
return;
}
csrfProtect();
$groups = new OTS_Groups_List();
$freePremium = isset($config['lua']['freePremium']) && getBoolean($config['lua']['freePremium']) || $account_logged->getPremDays() == OTS_Account::GRATIS_PREMIUM_DAYS;

2
system/pages/account/register-new.php
View File

@@ -17,6 +17,8 @@ if(!$logged) {
return;
}
csrfProtect();
if(isset($_POST['reg_password']))
$reg_password = encrypt((USE_ACCOUNT_SALT ? $account_logged->getCustomField('salt') : '') . $_POST['reg_password']);

2
system/pages/account/register.php
View File

@@ -17,6 +17,8 @@ if(!$logged) {
return;
}
csrfProtect();
$_POST['reg_password'] = $_POST['reg_password'] ?? '';
$reg_password = encrypt((USE_ACCOUNT_SALT ? $account_logged->getCustomField('salt') : '') . $_POST['reg_password']);
$old_key = $account_logged->getCustomField("key");