Digitalstack/myaac
2
0
Fork 0
mirror of https://github.com/slawkens/myaac.git synced 2025-10-18 11:43:26 +02:00
Code Issues Packages Projects Releases Wiki Activity

CSRF Protection (#235)

Browse Source 
* Fix alert class name

* feature: csrf protection

* Cosmetics

* Fix token generate

* Admin Panel: changelogs csrf protection

* news/id route

* Refactor admin newses + add csrf

* Use admin.links instead

* Admin panel: Pages csrf

* Menus: better csrf + add success message on reset colors

* Plugins csrf

* Move definitions

* add info function, same as note($message)

* Update mailer.php

* Fix new page/news links

* clear_cache & maintenance csrf

* Formatting

* Fix news type

* Fix changelog link

* Add new changelog link

* More info to confirm dialog

* This is always true
This commit is contained in:
Slawomir Boczek
2023-11-11 10:57:57 +01:00
committed by GitHub
parent a04fbde607
commit 790d85a88a
89 changed files with 789 additions and 504 deletions
Download Patch File Download Diff File Expand all files Collapse all files

136
system/templates/admin.news.html.twig
View File

@@ -1,136 +1,6 @@
<div class="card card-info card-outline">
<div class="card-header">
<h5 class="m-0">News:
<a href="?p=news&action=new&type=1" class="float-right"><span class="btn btn-sm btn-success">New</span></a>
</h5>
</div>
<div class="card-body">
<table class="tb_datatable table table-striped table-bordered table-responsive d-md-table">
<thead>
<tr>
<th width="5%">ID</th>
<th>Title</th>
<th>Date</th>
<th>Player</th>
<th style="width: 150px;">Options</th>
</tr>
</thead>
<tbody>
{% for news in newses[constant('NEWS')] %}
<tr>
<td>{{ news.id|raw }}</td>
<td><i><a href="?p=news&action=edit&id={{ news.id }}">{{ news.title }}</a></i></td>
<td>{{ news.date|date(setting('core.news_date_format')) }}</td>
<td><a target="_blank" rel="noopener noreferrer" href="{{ news.player_link }}">{{ news.player_name }}</a></td>
<td>
<div class="btn-group">
<a href="?p=news&action=edit&id={{ news.id }}" class="btn btn-success btn-sm" title="Edit">
<i class="fas fa-pencil-alt"></i>
</a>
<a href="?p=news&action=delete&id={{ news.id }}" class="btn btn-danger btn-sm" onclick="return confirm('Are you sure?');" title="Delete">
<i class="fas fa-trash"></i>
</a>
<a href="?p=news&action=hide&id={{ news.id }}" class="btn btn-{{ (news.hidden != 1) ? 'info' : 'default' }} btn-sm" title="{% if news.hidden != 1 %}Hide{% else %}Show{% endif %}">
<i class="fas fa-eye{{ (news.hidden != 1) ? '' : '-slash' }}"></i>
</a>
</div>
</td>
</tr>
{% endfor %}
</tbody>
</table>
</div>
</div>
<div class="card card-info card-outline">
<div class="card-header">
<h5 class="m-0">Tickers:
<a href="?p=news&action=new&type=2" class="float-right"><span class="btn btn-sm btn-success">New</span></a>
</h5>
</div>
<div class="card-body">
<table class="tb_datatable table table-striped table-bordered table-responsive d-md-table">
<thead>
<tr>
<th width="5%">ID</th>
<th>Title</th>
<th>Date</th>
<th>Player</th>
<th style="width: 150px;">Options</th>
</tr>
</thead>
<tbody>
{% for ticker in newses[constant('TICKER')] %}
<tr>
<td>{{ ticker.id|raw }}</td>
<td><i><a href="?p=news&action=edit&id={{ ticker.id }}">{{ ticker.title }}</a></i></td>
<td>{{ ticker.date|date(setting('core.news_date_format')) }}</td>
<td><a target="_blank" rel="noopener noreferrer" href="{{ ticker.player_link }}">{{ ticker.player_name }}</a></td>
<td>
<div class="btn-group">
<a href="?p=news&action=edit&id={{ ticker.id }}" class="btn btn-success btn-sm" title="Edit">
<i class="fas fa-pencil-alt"></i>
</a>
<a href="?p=news&action=delete&id={{ ticker.id }}" class="btn btn-danger btn-sm" onclick="return confirm('Are you sure?');" title="Delete">
<i class="fas fa-trash"></i>
</a>
<a href="?p=news&action=hide&id={{ ticker.id }}" class="btn btn-{{ (ticker.hidden != 1) ? 'info' : 'default' }} btn-sm" title="{% if ticker.hidden != 1 %}Hide{% else %}Show{% endif %}">
<i class="fas fa-eye{{ (ticker.hidden != 1) ? '' : '-slash' }}"></i>
</a>
</div>
</td>
</tr>
{% endfor %}
</tbody>
</table>
</div>
</div>
<div class="card card-info card-outline">
<div class="card-header">
<h5 class="m-0">Articles: <a href="?p=news&action=new&type=3" class="float-right"><span class="btn btn-sm btn-success">New</span></a>
</h5>
</div>
<div class="card-body">
<table class="tb_datatable table table-striped table-bordered table-responsive d-md-table">
<thead>
<tr>
<th width="5%">ID</th>
<th>Title</th>
<th>Date</th>
<th>Player</th>
<th style="width: 150px;">Options</th>
</tr>
</thead>
<tbody>
{% for article in newses[constant('ARTICLE')] %}
<tr>
<td>{{ article.id|raw }}</td>
<td><i><a href="?p=news&action=edit&id={{ article.id }}">{{ article.title }}</a></i></td>
<td>{{ article.date|date(setting('core.news_date_format')) }}</td>
<td><a target="_blank" rel="noopener noreferrer" href="{{ article.player_link }}">{{ article.player_name }}</a></td>
<td>
<div class="btn-group">
<a href="?p=news&action=edit&id={{ article.id }}" class="btn btn-success btn-sm" title="Edit">
<i class="fas fa-pencil-alt"></i>
</a>
<a href="?p=news&action=delete&id={{ article.id }}" class="btn btn-danger btn-sm" onclick="return confirm('Are you sure?');" title="Delete">
<i class="fas fa-trash"></i>
</a>
<a href="?p=news&action=hide&id={{ article.id }}" class="btn btn-{{ (article.hidden != 1) ? 'info' : 'default' }} btn-sm" title="{% if article.hidden != 1 %}Hide{% else %}Show{% endif %}">
<i class="fas fa-eye{{ (article.hidden != 1) ? '' : '-slash' }}"></i>
</a>
</div>
</td>
</tr>
{% endfor %}
</tbody>
</table>
</div>
</div>
{{ include('admin.news.table.html.twig', {type: 1, title: 'News'}) }}
{{ include('admin.news.table.html.twig', {type: 2, title: 'Tickers'}) }}
{{ include('admin.news.table.html.twig', {type: 3, title: 'Articles'}) }}
<script>
$(function () {