xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-08-22 02:57:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(admin): escape reflected request params in admin templates [#139] (#270)

Browse Source
This commit is contained in:
Ferywir
2026-06-23 16:37:11 +02:00
committed by GitHub
parent e17bb3dec6
commit 749a55aaf5
12 changed files with 23 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Admin/Templates/editResources.tpl
+2 -2
View File
@@ -46,7 +46,7 @@ if($id){
<form action="../GameEngine/Admin/Mods/editResources.php" method="POST">
<?php echo csrf_field(); ?>
<input type="hidden" name="admid" value="<?php echo $_SESSION['id']; ?>">
<input type="hidden" name="did" id="did" value="<?php echo $_GET['did']; ?>">
<input type="hidden" name="did" id="did" value="<?php echo (int)($_GET['did'] ?? 0); ?>">
<div class="res-card">
<div class="res-head">Modify Resources — <?php echo $village['name']; ?> (<?php echo $coor['x']; ?>|<?php echo $coor['y']; ?>)</div>
@@ -82,7 +82,7 @@ if($id){
</table>
<div class="res-actions">
<a href="../Admin/admin.php?p=village&did=<?php echo $_GET['did'];?>" class="btn-back">← Back to village</a>
<a href="../Admin/admin.php?p=village&did=<?php echo (int)($_GET['did'] ?? 0);?>" class="btn-back">← Back to village</a>
<button type="submit" class="btn-save">Save Changes</button>
</div>
</div>