Mibew/tray
1
0
Fork 0
mirror of https://github.com/Mibew/tray.git synced 2025-01-22 18:10:34 +03:00
Code Issues Actions Packages Projects Releases Wiki Activity

added auth token for delete offline messages check for csrf

Browse Source
This commit is contained in:
YuFei Zhu 2012-04-30 17:14:44 +01:00 committed by Dmitriy Simushev
parent 423c1335f4
commit cb77595747
3 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/messenger/webim/libs/common.php
View File

@ -779,7 +779,7 @@ function csrfchecktoken(){
die("CSRF failure");
}
} else if($_GET['act'] == 'del' && $_GET['csrf_token'] != $_SESSION['csrf_token']){
} else if(($_GET['act'] == 'del' || $_GET['act'] == 'delete') && $_GET['csrf_token'] != $_SESSION['csrf_token']){
die("CSRF failure");
}

2
src/messenger/webim/operator/canned.php
View File

@ -26,6 +26,8 @@ require_once('../libs/settings.php');
require_once('../libs/groups.php');
require_once('../libs/pagination.php');
csrfchecktoken();
$operator = check_login();
force_password($operator);

4
src/messenger/webim/view/canned.php
View File

@ -95,7 +95,7 @@ if( $page['pagination.items'] ) {
<td>
<a href="<?php echo $webimroot ?>/operator/cannededit.php?key=<?php echo $localstr['id'] ?>" target="_blank"
onclick="this.newWindow = window.open('<?php echo $webimroot ?>/operator/cannededit.php?key=<?php echo $localstr['id'] ?>', '', 'toolbar=0,scrollbars=1,location=0,status=1,menubar=0,width=640,height=480,resizable=1');this.newWindow.focus();this.newWindow.opener=window;return false;"><?php echo getlocal("canned.actions.edit") ?></a>,
<a href="<?php echo $webimroot ?>/operator/canned.php?act=delete&amp;key=<?php echo $localstr['id'] ?>&amp;lang=<?php echo form_value("lang") ?>&amp;group=<?php echo form_value("group")?>"><?php echo getlocal("canned.actions.del") ?></a>
<a href="<?php echo $webimroot ?>/operator/canned.php?act=delete&amp;key=<?php echo $localstr['id'] ?>&amp;lang=<?php echo form_value("lang") ?>&amp;group=<?php echo form_value("group")?><?php print_csrf_token_in_url() ?>"><?php echo getlocal("canned.actions.del") ?></a>
</td>
</tr>
<?php
@ -124,4 +124,4 @@ if( $page['pagination.items'] ) {
} /* content */
require_once('inc_main.php');
?>
?>