diff --git a/admin/pages/accounts.php b/admin/pages/accounts.php index 214b82f0..4d410f11 100644 --- a/admin/pages/accounts.php +++ b/admin/pages/accounts.php @@ -13,6 +13,9 @@ use MyAAC\Models\Player; defined('MYAAC') or die('Direct access not allowed!'); $title = 'Account editor'; + +csrfProtect(); + $admin_base = ADMIN_URL . '?p=accounts'; $use_datatable = true; @@ -82,7 +85,7 @@ else if (isset($_REQUEST['search'])) { $account = new OTS_Account(); $account->load($id); - if (isset($account, $_POST['save']) && $account->isLoaded()) { + if (isset($_POST['save']) && $account->isLoaded()) { $error = false; $_error = ''; @@ -289,6 +292,7 @@ else if (isset($_REQUEST['search'])) {
+
@@ -581,6 +585,7 @@ else if (isset($_REQUEST['search'])) {
+
@@ -590,6 +595,7 @@ else if (isset($_REQUEST['search'])) {
+
diff --git a/admin/pages/changelog.php b/admin/pages/changelog.php index 3d5cad64..ae2fd7b0 100644 --- a/admin/pages/changelog.php +++ b/admin/pages/changelog.php @@ -13,30 +13,29 @@ use MyAAC\Models\Changelog as ModelsChangelog; defined('MYAAC') or die('Direct access not allowed!'); +$title = 'Changelog'; + +csrfProtect(); + if (!hasFlag(FLAG_CONTENT_PAGES) && !superAdmin()) { echo 'Access denied.'; return; } -$title = 'Changelog'; $use_datatable = true; const CL_LIMIT = 600; // maximum changelog body length -?> - - -orderBy('group_id', POT::ORDER_DESC); $twig->display('admin.changelog.form.html.twig', array( 'action' => $action, - 'cl_link_form' => constant('ADMIN_URL').'?p=changelog&action=' . ($action == 'edit' ? 'edit' : 'new'), + 'cl_link_form' => constant('ADMIN_URL').'?p=changelog', 'cl_id' => $id ?? null, 'body' => isset($body) ? escapeHtml($body) : '', 'create_date' => $create_date ?? '', @@ -128,15 +129,3 @@ if($action == 'edit' || $action == 'new') { $twig->display('admin.changelog.html.twig', array( 'changelogs' => $changelogs, )); - -?> - diff --git a/admin/pages/dashboard.php b/admin/pages/dashboard.php index e24b98ad..73430456 100644 --- a/admin/pages/dashboard.php +++ b/admin/pages/dashboard.php @@ -10,7 +10,9 @@ defined('MYAAC') or die('Direct access not allowed!'); $title = 'Dashboard'; -if (isset($_GET['clear_cache'])) { +csrfProtect(); + +if (isset($_POST['clear_cache'])) { if (clearCache()) { success('Cache cleared.'); } else { @@ -18,7 +20,7 @@ if (isset($_GET['clear_cache'])) { } } -if (isset($_GET['maintenance'])) { +if (isset($_POST['maintenance'])) { $message = (!empty($_POST['message']) ? $_POST['message'] : null); $_status = (isset($_POST['status']) && $_POST['status'] == 'true'); $_status = ($_status ? '0' : '1'); diff --git a/admin/pages/login.php b/admin/pages/login.php index 8bb25f36..eb6466d3 100644 --- a/admin/pages/login.php +++ b/admin/pages/login.php @@ -10,6 +10,8 @@ defined('MYAAC') or die('Direct access not allowed!'); $title = 'Login'; +csrfProtect(); + require PAGES . 'account/login.php'; if ($logged) { header('Location: ' . (admin() ? ADMIN_URL : BASE_URL)); diff --git a/admin/pages/mailer.php b/admin/pages/mailer.php index 732b7461..d9cf8888 100644 --- a/admin/pages/mailer.php +++ b/admin/pages/mailer.php @@ -10,6 +10,8 @@ defined('MYAAC') or die('Direct access not allowed!'); $title = 'Mailer'; +csrfProtect(); + if (!hasFlag(FLAG_CONTENT_MAILER) && !superAdmin()) { echo 'Access denied.'; return; @@ -20,7 +22,7 @@ if (!setting('core.mail_enabled')) { return; } -$mail_to = isset($_REQUEST['mail_to']) ? stripslashes(trim($_REQUEST['mail_to'])) : null; +$mail_to = isset($_POST['mail_to']) ? stripslashes(trim($_POST['mail_to'])) : null; $mail_subject = isset($_POST['mail_subject']) ? stripslashes($_POST['mail_subject']) : null; $mail_content = isset($_POST['mail_content']) ? stripslashes($_POST['mail_content']) : null; diff --git a/admin/pages/mass_account.php b/admin/pages/mass_account.php index 63bec54c..549310a5 100644 --- a/admin/pages/mass_account.php +++ b/admin/pages/mass_account.php @@ -16,6 +16,8 @@ defined('MYAAC') or die('Direct access not allowed!'); $title = 'Mass Account Actions'; +csrfProtect(); + $hasCoinsColumn = $db->hasColumn('accounts', 'coins'); $hasPointsColumn = $db->hasColumn('accounts', 'premium_points'); $freePremium = $config['lua']['freePremium']; diff --git a/admin/pages/mass_teleport.php b/admin/pages/mass_teleport.php index 5027fa1c..f2a7ee27 100644 --- a/admin/pages/mass_teleport.php +++ b/admin/pages/mass_teleport.php @@ -16,6 +16,8 @@ defined('MYAAC') or die('Direct access not allowed!'); $title = 'Mass Teleport Actions'; +csrfProtect(); + function admin_teleport_position($x, $y, $z) { if (!Player::query()->update([ 'posx' => $x, 'posy' => $y, 'posz' => $z diff --git a/admin/pages/menus.php b/admin/pages/menus.php index a0b492df..4a908eb5 100644 --- a/admin/pages/menus.php +++ b/admin/pages/menus.php @@ -13,19 +13,21 @@ use MyAAC\Models\Menu; defined('MYAAC') or die('Direct access not allowed!'); $title = 'Menus'; +csrfProtect(); + if (!hasFlag(FLAG_CONTENT_MENUS) && !superAdmin()) { echo 'Access denied.'; return; } -if (isset($_REQUEST['template'])) { - $template = $_REQUEST['template']; +if (isset($_POST['template'])) { + $template = $_POST['template']; - if (isset($_REQUEST['menu'])) { - $post_menu = $_REQUEST['menu']; - $post_menu_link = $_REQUEST['menu_link']; - $post_menu_blank = $_REQUEST['menu_blank']; - $post_menu_color = $_REQUEST['menu_color']; + if (isset($_POST['menu'])) { + $post_menu = $_POST['menu']; + $post_menu_link = $_POST['menu_link']; + $post_menu_blank = $_POST['menu_blank']; + $post_menu_color = $_POST['menu_color']; if (count($post_menu) != count($post_menu_link)) { echo 'Menu count is not equal menu links. Something went wrong when sending form.'; return; @@ -69,9 +71,10 @@ if (isset($_REQUEST['template'])) { return; } - if (isset($_REQUEST['reset_colors'])) { + if (isset($_GET['reset_colors'])) { if (isset($config['menu_default_color'])) { Menu::where('template', $template)->update(['color' => str_replace('#', '', $config['menu_default_color'])]); + success('Colors has been reset.'); } else { warning('There is no default color defined, cannot reset colors.'); @@ -93,6 +96,7 @@ if (isset($_REQUEST['template'])) {

+ @@ -112,6 +116,7 @@ if (isset($_REQUEST['template'])) { $last_id = array(); ?>