Digitalstack/myaac
2
0
Fork 0
mirror of https://github.com/slawkens/myaac.git synced 2025-10-18 03:33:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

Protect against csrf in more places (accounts & guilds pages)

Browse Source
This commit is contained in:
slawkens
2025-05-24 09:52:56 +02:00
parent 72cdd290da
commit 6eda38603c
21 changed files with 43 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
system/pages/forum/edit_post.php
View File

@@ -18,6 +18,8 @@ if ($ret === false) {
return;
}
csrfProtect();
if(!$logged) {
echo 'You are not logged in. <a href="' . getLink('account/manage') . '?redirect=' . urlencode(getLink('forum')) . '">Log in</a> to post on the forum.<br /><br />';
return;

2
system/pages/forum/move_thread.php
View File

@@ -18,6 +18,8 @@ if ($ret === false) {
return;
}
csrfProtect();
if(!$logged) {
echo 'You are not logged in. <a href="' . getLink('account/manage') . '?redirect=' . urlencode(getLink('forum')) . '">Log in</a> to post on the forum.<br /><br />';
return;

2
system/pages/forum/new_post.php
View File

@@ -28,6 +28,8 @@ if(!$logged) {
return;
}
csrfProtect();
if(Forum::canPost($account_logged)) {
$players_from_account = $db->query("SELECT `players`.`name`, `players`.`id` FROM `players` WHERE `players`.`account_id` = ".(int) $account_logged->getId())->fetchAll();
$thread_id = isset($_REQUEST['thread_id']) ? (int) $_REQUEST['thread_id'] : 0;

2
system/pages/forum/new_thread.php
View File

@@ -28,6 +28,8 @@ if(!$logged) {
return;
}
csrfProtect();
if(Forum::canPost($account_logged)) {
$players_from_account = $db->query('SELECT `players`.`name`, `players`.`id` FROM `players` WHERE `players`.`account_id` = '.(int) $account_logged->getId())->fetchAll();
$section_id = $_REQUEST['section_id'] ?? null;

2
system/pages/forum/remove_post.php
View File

@@ -23,6 +23,8 @@ if(!$logged) {
return;
}
csrfProtect();
if(Forum::isModerator()) {
$id = (int) $_REQUEST['id'];
$post = $db->query("SELECT `id`, `first_post`, `section` FROM `" . FORUM_TABLE_PREFIX . "forum` WHERE `id` = ".$id." LIMIT 1")->fetch();