Implement additional CSRF checks

src/mibew/operator/ban.php

@@ -22,6 +22,7 @@ require_once(dirname(dirname(__FILE__)).'/libs/pagination.php');
 require_once(dirname(dirname(__FILE__)).'/libs/classes/thread.php');
 
 $operator = check_login();
+csrfchecktoken();
 $page = array('banId' => '');
 $page['saved'] = false;
 $page['thread'] = '';

src/mibew/operator/blocked.php

@@ -21,6 +21,8 @@ require_once(dirname(dirname(__FILE__)).'/libs/operator.php');
 require_once(dirname(dirname(__FILE__)).'/libs/pagination.php');
 
 $operator = check_login();
+csrfchecktoken();
+
 $page = array();
 $errors = array();
 

src/mibew/operator/group.php

@@ -20,6 +20,7 @@ require_once(dirname(dirname(__FILE__)).'/libs/operator.php');
 require_once(dirname(dirname(__FILE__)).'/libs/groups.php');
 
 $operator = check_login();
+csrfchecktoken();
 
 $page = array('grid' => '');
 $errors = array();

src/mibew/operator/groupmembers.php

@@ -20,6 +20,7 @@ require_once(dirname(dirname(__FILE__)).'/libs/operator.php');
 require_once(dirname(dirname(__FILE__)).'/libs/groups.php');
 
 $operator = check_login();
+csrfchecktoken();
 
 function get_group_members($groupid)
 {

src/mibew/operator/groups.php

@@ -19,6 +19,7 @@ require_once(dirname(dirname(__FILE__)).'/libs/init.php');
 require_once(dirname(dirname(__FILE__)).'/libs/operator.php');
 
 $operator = check_login();
+csrfchecktoken();
 
 if (isset($_GET['act']) && $_GET['act'] == 'del') {
 

src/mibew/operator/opgroups.php

@@ -20,6 +20,7 @@ require_once(dirname(dirname(__FILE__)).'/libs/operator.php');
 require_once(dirname(dirname(__FILE__)).'/libs/operator_settings.php');
 
 $operator = check_login();
+csrfchecktoken();
 
 function update_operator_groups($operatorid, $newvalue)
 {

src/mibew/view/ban.php

@@ -31,7 +31,7 @@ function tpl_content() { global $page, $mibewroot, $errors;
 <?php echo getlocal("page_ban.intro") ?>
 <br/>
 <br/>
-<?php 
+<?php
 require_once(dirname(__FILE__).'/inc_errors.php');
 ?>
 
@@ -42,6 +42,7 @@ require_once(dirname(__FILE__).'/inc_errors.php');
 <?php } ?>
 
 <form name="banForm" method="post" action="<?php echo $mibewroot ?>/operator/ban.php">
+<?php print_csrf_token_input() ?>
 <input type="hidden" name="banId" value="<?php echo $page['banId'] ?>"/>
 <?php if( $page['threadid'] ) { ?>
 <input type="hidden" name="threadid" value="<?php echo $page['threadid'] ?>"/>

src/mibew/view/blocked_visitors.php

@@ -82,7 +82,7 @@ if( $page['pagination.items'] ) {
 ?>
 	</td>
 	<td>
-		<a class="removelink" id="i<?php echo $b['banid'] ?>" href="<?php echo $mibewroot ?>/operator/blocked.php?act=del&amp;id=<?php echo $b['banid'] ?>">
+		<a class="removelink" id="i<?php echo $b['banid'] ?>" href="<?php echo $mibewroot ?>/operator/blocked.php?act=del&amp;id=<?php echo $b['banid'] ?><?php print_csrf_token_in_url() ?>">
 			<?php echo getlocal("remove.item") ?></a>,
 		<a href="<?php echo $mibewroot ?>/operator/ban.php?id=<?php echo $b['banid'] ?>">
 			<?php echo getlocal("edit.item") ?></a>

src/mibew/view/group.php

@@ -63,6 +63,7 @@ require_once(dirname(__FILE__).'/inc_errors.php');
 <?php } ?>
 
 <form name="groupForm" method="post" action="<?php echo $mibewroot ?>/operator/group.php">
+<?php print_csrf_token_input() ?>
 <input type="hidden" name="gid" value="<?php echo $page['grid'] ?>"/>
 	<div>
 <?php print_tabbar(); ?>

src/mibew/view/groupmembers.php

@@ -35,6 +35,7 @@ require_once(dirname(__FILE__).'/inc_errors.php');
 <?php } ?>
 
 <form name="membersForm" method="post" action="<?php echo $mibewroot ?>/operator/groupmembers.php">
+<?php print_csrf_token_input() ?>
 <input type="hidden" name="gid" value="<?php echo $page['groupid'] ?>"/>
 	<div>
 <?php print_tabbar(); ?>

src/mibew/view/groups.php

@@ -122,7 +122,7 @@ if(count($page['groups']) > 0) {
 	</td>
 <?php if($page['canmodify']) { ?>
 	<td>
-		<a href="<?php echo $mibewroot ?>/operator/groups.php?act=del&amp;gid=<?php echo $grp['groupid'] ?>" id="i<?php echo $grp['groupid'] ?>" class="removelink">
+		<a href="<?php echo $mibewroot ?>/operator/groups.php?act=del&amp;gid=<?php echo $grp['groupid'] ?><?php print_csrf_token_in_url() ?>" id="i<?php echo $grp['groupid'] ?>" class="removelink">
 			<?php echo getlocal("remove.item") ?>
 		</a>
 	</td>

src/mibew/view/operator_groups.php

@@ -35,6 +35,7 @@ require_once(dirname(__FILE__).'/inc_errors.php');
 <?php } ?>
 
 <form name="opgroupsForm" method="post" action="<?php echo $mibewroot ?>/operator/opgroups.php">
+<?php print_csrf_token_input() ?>
 <input type="hidden" name="op" value="<?php echo $page['opid'] ?>"/>
 	<div>
 <?php print_tabbar(); ?>