From 886f421f50960ac69dbd33f4e6909d79df1f3f48 Mon Sep 17 00:00:00 2001
From: Ferywir <65760459+Ferywir@users.noreply.github.com>
Date: Tue, 23 Jun 2026 15:12:54 +0200
Subject: [PATCH] fix(admin): verify CSRF token in server-settings admin Mods
 [#139] (#268)

---
 Admin/Templates/debug_log.tpl              | 3 +++
 Admin/Templates/editAdminInfo.tpl          | 1 +
 Admin/Templates/editExtraSet.tpl           | 1 +
 Admin/Templates/editLogSet.tpl             | 1 +
 Admin/Templates/editNewFunctions.tpl       | 1 +
 Admin/Templates/editNewsboxSet.tpl         | 1 +
 Admin/Templates/editOverall.tpl            | 1 +
 Admin/Templates/editPlusSet.tpl            | 1 +
 Admin/Templates/editServerSet.tpl          | 1 +
 Admin/Templates/editWeek.tpl               | 1 +
 GameEngine/Admin/Mods/debugLog.php         | 9 +++++++++
 GameEngine/Admin/Mods/editAdminInfo.php    | 6 ++++++
 GameEngine/Admin/Mods/editExtraSet.php     | 6 ++++++
 GameEngine/Admin/Mods/editLogSet.php       | 6 ++++++
 GameEngine/Admin/Mods/editNewFunctions.php | 6 ++++++
 GameEngine/Admin/Mods/editNewsboxSet.php   | 6 ++++++
 GameEngine/Admin/Mods/editOverall.php      | 5 +++++
 GameEngine/Admin/Mods/editPlusSet.php      | 6 ++++++
 GameEngine/Admin/Mods/editServerSet.php    | 6 ++++++
 GameEngine/Admin/Mods/editWeek.php         | 5 +++++
 20 files changed, 73 insertions(+)

diff --git a/Admin/Templates/debug_log.tpl b/Admin/Templates/debug_log.tpl
index 9bb496dc..b333b350 100644
--- a/Admin/Templates/debug_log.tpl
+++ b/Admin/Templates/debug_log.tpl
@@ -89,6 +89,7 @@ $autoOff = (int)($cfg['auto_off_hours'] ?? 0);
       <span>Log size: <b><?php echo number_format($logSize / 1024, 1); ?> KB</b></span>
     </div>
     <form action="../GameEngine/Admin/Mods/debugLog.php" method="POST" style="display:inline">
+      <?php echo csrf_field(); ?>
       <input type="hidden" name="do" value="toggle">
       <input type="hidden" name="active" value="<?php echo $isOn ? 0 : 1; ?>">
       <button type="submit" class="dbg-btn <?php echo $isOn ? 'red' : 'green'; ?>">
@@ -101,6 +102,7 @@ $autoOff = (int)($cfg['auto_off_hours'] ?? 0);
   <div class="dbg-card">
     <h3>Capture settings</h3>
     <form action="../GameEngine/Admin/Mods/debugLog.php" method="POST">
+      <?php echo csrf_field(); ?>
       <input type="hidden" name="do" value="save">
       <div class="dbg-row">
         <label><input type="checkbox" name="lvl_warning"    <?php echo !empty($cfg['lvl_warning'])    ? 'checked' : ''; ?>> Warnings</label>
@@ -127,6 +129,7 @@ $autoOff = (int)($cfg['auto_off_hours'] ?? 0);
       <a class="dbg-btn" href="../GameEngine/Admin/Mods/debugLog.php?do=download">⬇ Download full log</a>
       <form action="../GameEngine/Admin/Mods/debugLog.php" method="POST" style="display:inline"
             onsubmit="return confirm('Clear the debug log file?');">
+        <?php echo csrf_field(); ?>
         <input type="hidden" name="do" value="clear">
         <button type="submit" class="dbg-btn red">🗑 Clear log</button>
       </form>
diff --git a/Admin/Templates/editAdminInfo.tpl b/Admin/Templates/editAdminInfo.tpl
index 6c770065..f2fff180 100644
--- a/Admin/Templates/editAdminInfo.tpl
+++ b/Admin/Templates/editAdminInfo.tpl
@@ -58,6 +58,7 @@ if($_SESSION['access'] < 9) die(ACCESS_DENIED_ADMIN);
     <div class="config-title"><?php echo SERV_CONFIG ?></div>
     
     <form action="../GameEngine/Admin/Mods/editAdminInfo.php" method="POST">
+        <?php echo csrf_field(); ?>
         <input type="hidden" name="id" id="id" value="<?php echo $_SESSION['id']; ?>">
         
         <div class="config-card">
diff --git a/Admin/Templates/editExtraSet.tpl b/Admin/Templates/editExtraSet.tpl
index b83106c7..0f3fe1df 100644
--- a/Admin/Templates/editExtraSet.tpl
+++ b/Admin/Templates/editExtraSet.tpl
@@ -58,6 +58,7 @@ if($_SESSION['access'] < 9) die(ACCESS_DENIED_ADMIN);
     <div class="config-title"><?php echo SERV_CONFIG ?></div>
     
     <form action="../GameEngine/Admin/Mods/editExtraSet.php" method="POST">
+        <?php echo csrf_field(); ?>
         <input type="hidden" name="id" id="id" value="<?php echo $_SESSION['id']; ?>">
         
         <div class="config-card">
diff --git a/Admin/Templates/editLogSet.tpl b/Admin/Templates/editLogSet.tpl
index 88e9739f..3f330cc8 100644
--- a/Admin/Templates/editLogSet.tpl
+++ b/Admin/Templates/editLogSet.tpl
@@ -58,6 +58,7 @@ if($_SESSION['access'] < 9) die(ACCESS_DENIED_ADMIN);
     <div class="config-title"><?php echo SERV_CONFIG ?></div>
     
     <form action="../GameEngine/Admin/Mods/editLogSet.php" method="POST">
+        <?php echo csrf_field(); ?>
         <input type="hidden" name="id" id="id" value="<?php echo $_SESSION['id']; ?>">
         
         <div class="config-card">
diff --git a/Admin/Templates/editNewFunctions.tpl b/Admin/Templates/editNewFunctions.tpl
index 4d63d954..226957fe 100644
--- a/Admin/Templates/editNewFunctions.tpl
+++ b/Admin/Templates/editNewFunctions.tpl
@@ -58,6 +58,7 @@ if($_SESSION['access'] < 9) die(ACCESS_DENIED_ADMIN);
     <div class="config-title"><?php echo SERV_CONFIG ?></div>
     
     <form action="../GameEngine/Admin/Mods/editNewFunctions.php" method="POST">
+        <?php echo csrf_field(); ?>
         <input type="hidden" name="id" id="id" value="<?php echo $_SESSION['id']; ?>">
         
         <div class="config-card">
diff --git a/Admin/Templates/editNewsboxSet.tpl b/Admin/Templates/editNewsboxSet.tpl
index 67801efa..07667fc8 100644
--- a/Admin/Templates/editNewsboxSet.tpl
+++ b/Admin/Templates/editNewsboxSet.tpl
@@ -58,6 +58,7 @@ if($_SESSION['access'] < 9) die(ACCESS_DENIED_ADMIN);
     <div class="config-title"><?php echo SERV_CONFIG ?></div>
     
     <form action="../GameEngine/Admin/Mods/editNewsboxSet.php" method="POST">
+        <?php echo csrf_field(); ?>
         <input type="hidden" name="id" id="id" value="<?php echo $_SESSION['id']; ?>">
         
         <div class="config-card">
diff --git a/Admin/Templates/editOverall.tpl b/Admin/Templates/editOverall.tpl
index a0821e60..81c14ed3 100644
--- a/Admin/Templates/editOverall.tpl
+++ b/Admin/Templates/editOverall.tpl
@@ -64,6 +64,7 @@ if($id){
     </div>
 
     <form action="../GameEngine/Admin/Mods/editOverall.php" method="POST">
+        <?php echo csrf_field(); ?>
         <input type="hidden" name="admid" value="<?php echo $_SESSION['id']; ?>">
         <input type="hidden" name="uid" value="<?php echo $uid; ?>">
         <input type="hidden" name="id" value="<?php echo $id; ?>">
diff --git a/Admin/Templates/editPlusSet.tpl b/Admin/Templates/editPlusSet.tpl
index ad8f0c45..ee998e2f 100644
--- a/Admin/Templates/editPlusSet.tpl
+++ b/Admin/Templates/editPlusSet.tpl
@@ -59,6 +59,7 @@ if($_SESSION['access'] < 9) die(ACCESS_DENIED_ADMIN);
     <div class="config-title"><?php echo PLUS_CONFIGURATION ?></div>
     
     <form action="../GameEngine/Admin/Mods/editPlusSet.php" method="POST">
+        <?php echo csrf_field(); ?>
         <input type="hidden" name="id" id="id" value="<?php echo $_SESSION['id']; ?>">
         
         <div class="config-card">
diff --git a/Admin/Templates/editServerSet.tpl b/Admin/Templates/editServerSet.tpl
index 68c5a3f0..3546d12f 100644
--- a/Admin/Templates/editServerSet.tpl
+++ b/Admin/Templates/editServerSet.tpl
@@ -64,6 +64,7 @@ function refresh(tz) {
     <div class="config-title"><?php echo SERV_CONFIG ?></div>
     
     <form action="../GameEngine/Admin/Mods/editServerSet.php" method="POST">
+        <?php echo csrf_field(); ?>
         <input type="hidden" name="id" id="id" value="<?php echo $_SESSION['id']; ?>">
         
         <div class="config-card">
diff --git a/Admin/Templates/editWeek.tpl b/Admin/Templates/editWeek.tpl
index f0d852a0..49cccc68 100644
--- a/Admin/Templates/editWeek.tpl
+++ b/Admin/Templates/editWeek.tpl
@@ -66,6 +66,7 @@ if($id){
     </div>
 
     <form action="../GameEngine/Admin/Mods/editWeek.php" method="POST">
+        <?php echo csrf_field(); ?>
         <input type="hidden" name="admid" value="<?php echo $_SESSION['id']; ?>">
         <input type="hidden" name="uid" value="<?php echo $uid; ?>">
         <input type="hidden" name="id" value="<?php echo $id; ?>">
diff --git a/GameEngine/Admin/Mods/debugLog.php b/GameEngine/Admin/Mods/debugLog.php
index d6b35e59..89309be1 100644
--- a/GameEngine/Admin/Mods/debugLog.php
+++ b/GameEngine/Admin/Mods/debugLog.php
@@ -17,6 +17,15 @@
 if(!isset($_SESSION)) session_start();
 if(($_SESSION['access'] ?? 0) < 9) die("Access denied: You are not Admin!");
 
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()). Only POST
+// requests mutate state; the ?do=download link is a plain GET (a read) and must
+// not be blocked, so guard the check on the request method.
+require_once(__DIR__ . '/../csrf.php');
+if (($_SERVER['REQUEST_METHOD'] ?? '') === 'POST') {
+    csrf_verify();
+}
+
 include_once("../../Database.php");
 
 // Resolve project root (max 5 levels up), like the rest of the codebase.
diff --git a/GameEngine/Admin/Mods/editAdminInfo.php b/GameEngine/Admin/Mods/editAdminInfo.php
index 534eebf6..2074ceb8 100755
--- a/GameEngine/Admin/Mods/editAdminInfo.php
+++ b/GameEngine/Admin/Mods/editAdminInfo.php
@@ -11,6 +11,12 @@
 
 if(!isset($_SESSION)) session_start();
 if($_SESSION['access'] < 9) die(ACCESS_DENIED_ADMIN);
+
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../Database.php");
 $id = (int) $_POST['id'];
 
diff --git a/GameEngine/Admin/Mods/editExtraSet.php b/GameEngine/Admin/Mods/editExtraSet.php
index aca89d7a..f2553bf9 100755
--- a/GameEngine/Admin/Mods/editExtraSet.php
+++ b/GameEngine/Admin/Mods/editExtraSet.php
@@ -11,6 +11,12 @@
 
 if(!isset($_SESSION)) session_start();
 if($_SESSION['access'] < 9) die(ACCESS_DENIED_ADMIN);
+
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../Database.php");
 $id = (int) $_POST['id'];
 
diff --git a/GameEngine/Admin/Mods/editLogSet.php b/GameEngine/Admin/Mods/editLogSet.php
index ba66d739..dedf580d 100755
--- a/GameEngine/Admin/Mods/editLogSet.php
+++ b/GameEngine/Admin/Mods/editLogSet.php
@@ -11,6 +11,12 @@
 
 if(!isset($_SESSION)) session_start();
 if($_SESSION['access'] < 9) die(ACCESS_DENIED_ADMIN);
+
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../Database.php");
 $id = (int) $_POST['id'];
 
diff --git a/GameEngine/Admin/Mods/editNewFunctions.php b/GameEngine/Admin/Mods/editNewFunctions.php
index 9a331a60..ccde840d 100644
--- a/GameEngine/Admin/Mods/editNewFunctions.php
+++ b/GameEngine/Admin/Mods/editNewFunctions.php
@@ -11,6 +11,12 @@
 
 if(!isset($_SESSION)) session_start();
 if($_SESSION['access'] < 9) die(ACCESS_DENIED_ADMIN);
+
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../Database.php");
 $id = (int) $_POST['id'];
 
diff --git a/GameEngine/Admin/Mods/editNewsboxSet.php b/GameEngine/Admin/Mods/editNewsboxSet.php
index ab89c499..c2a40703 100755
--- a/GameEngine/Admin/Mods/editNewsboxSet.php
+++ b/GameEngine/Admin/Mods/editNewsboxSet.php
@@ -11,6 +11,12 @@
 
 if(!isset($_SESSION)) session_start();
 if($_SESSION['access'] < 9) die(ACCESS_DENIED_ADMIN);
+
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../Database.php");
 $id = (int) $_POST['id'];
 
diff --git a/GameEngine/Admin/Mods/editOverall.php b/GameEngine/Admin/Mods/editOverall.php
index 3152534a..bf7e744d 100755
--- a/GameEngine/Admin/Mods/editOverall.php
+++ b/GameEngine/Admin/Mods/editOverall.php
@@ -17,6 +17,11 @@ if (empty($_SESSION['access']) || $_SESSION['access'] < 9) {
     die("Access Denied: You are not Admin!");
 }
 
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../config.php");
 
 // ---------------------------------------------------------------------------
diff --git a/GameEngine/Admin/Mods/editPlusSet.php b/GameEngine/Admin/Mods/editPlusSet.php
index 48568067..39e1e7e2 100644
--- a/GameEngine/Admin/Mods/editPlusSet.php
+++ b/GameEngine/Admin/Mods/editPlusSet.php
@@ -11,6 +11,12 @@
 
 if(!isset($_SESSION)) session_start();
 if($_SESSION['access'] < 9) die(ACCESS_DENIED_ADMIN);
+
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../Database.php");
 include_once("../../config.php");
 $id = (int) $_POST['id'];
diff --git a/GameEngine/Admin/Mods/editServerSet.php b/GameEngine/Admin/Mods/editServerSet.php
index 901921de..efda7b43 100755
--- a/GameEngine/Admin/Mods/editServerSet.php
+++ b/GameEngine/Admin/Mods/editServerSet.php
@@ -11,6 +11,12 @@
 
 if(!isset($_SESSION)) session_start();
 if($_SESSION['access'] < 9) die(ACCESS_DENIED_ADMIN);
+
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../Database.php");
 $id = (int) $_POST['id'];
 
diff --git a/GameEngine/Admin/Mods/editWeek.php b/GameEngine/Admin/Mods/editWeek.php
index 380f30bb..3a2a5fe9 100755
--- a/GameEngine/Admin/Mods/editWeek.php
+++ b/GameEngine/Admin/Mods/editWeek.php
@@ -17,6 +17,11 @@ if (empty($_SESSION['access']) || $_SESSION['access'] < 9) {
     die("Access Denied: You are not Admin!");
 }
 
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../config.php");
 
 // ---------------------------------------------------------------------------