xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-07-06 21:04:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(admin): verify CSRF token in message admin Mods [#139] (#264)

Browse Source 
sendMessage, massmessage and sysmessage are POSTed to directly, bypassing
admin.php's central csrf_verify(). Add csrf_verify() (after the admin access
check, via the shared GameEngine/Admin/csrf.php) and csrf_field() in their
forms (Newmessage.tpl, massmessage.tpl, sysmessage.tpl; the mass/sys templates
have both a prepare and an execute form).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Ferywir
2026-06-23 10:49:32 +02:00
committed by GitHub
parent 5f86fdcbf6
commit 6472b30bd2
6 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
GameEngine/Admin/Mods/sysmessage.php
+5
View File
@@ -24,6 +24,11 @@ if (!isset($_SESSION['access']) || $_SESSION['access'] < ADMIN) {
die("Access Denied");
}
// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
// itself (it does not go through admin.php's central csrf_verify()).
require_once(__DIR__ . '/../csrf.php');
csrf_verify();
// ---------------------------------------------------------------------------
// Resolve project root (so we can read/write Templates/*.tpl)
// ---------------------------------------------------------------------------