xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-08-16 16:21:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(admin): verify CSRF token in message admin Mods [#139] (#264)

Browse Source 
sendMessage, massmessage and sysmessage are POSTed to directly, bypassing
admin.php's central csrf_verify(). Add csrf_verify() (after the admin access
check, via the shared GameEngine/Admin/csrf.php) and csrf_field() in their
forms (Newmessage.tpl, massmessage.tpl, sysmessage.tpl; the mass/sys templates
have both a prepare and an execute form).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Ferywir
2026-06-23 10:49:32 +02:00
committed by GitHub
parent 5f86fdcbf6
commit 6472b30bd2
6 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Admin/Templates/sysmessage.tpl
+2 -1
View File
@@ -68,6 +68,7 @@ $_SESSION['sys_color'] = $_SESSION['sys_color'] ?? 'black';
</div>
<form action="../GameEngine/Admin/Mods/sysmessage.php" method="POST" class="sysmsg-form">
<?php echo csrf_field(); ?>
<input type="hidden" name="admid" value="<?=$id?>">
<input type="hidden" name="action" value="execute">
@@ -84,7 +85,7 @@ $_SESSION['sys_color'] = $_SESSION['sys_color'] ?? 'black';
<?php else: ?>
<form action="../GameEngine/Admin/Mods/sysmessage.php" method="POST" class="sysmsg-form">
<?php echo csrf_field(); ?>
<input type="hidden" name="admid" value="<?=$id?>">
<input type="hidden" name="action" value="prepare">