xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-09-17 23:57:18 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(admin): verify CSRF token in alliance/medal admin Mods [#139] (#261)

Browse Source 
editAli, delAli, medals, delallymedal, delallymedalbyaid, delallymedalbyweek
and deletemedalbyweek are POSTed to directly, bypassing admin.php's central
csrf_verify(). Add csrf_verify() (after the admin access check, via the shared
GameEngine/Admin/csrf.php) and csrf_field() in their forms (playermedals.tpl,
editAli.tpl, delAli.tpl, delmedal.tpl, allymedals.tpl, delallymedal.tpl).

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Ferywir
2026-06-23 10:11:32 +02:00
committed by GitHub
parent e4658f250f
commit 8a3a67d175
13 changed files with 44 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Admin/Templates/allymedals.tpl
+2
View File
@@ -63,6 +63,7 @@ $varmedal = $database->getProfileMedalAlly($_GET['aid']);
<td><img src="../gpack/travian_default/img/t/<?=$medal['img']?>.jpg"></td>
<td>
<form action="../GameEngine/Admin/Mods/delallymedal.php" method="POST" style="margin:0">
<?php echo csrf_field(); ?>
<input type="hidden" name="aid" value="<?=$_GET['aid']?>">
<input type="hidden" name="admid" value="<?=$_SESSION['id']?>">
<button type="submit" name="medalid" value="<?=$medal['id']?>" class="medal-del" title="Delete">
@@ -81,6 +82,7 @@ $varmedal = $database->getProfileMedalAlly($_GET['aid']);
<td>Delete All</td>
<td>
<form action="../GameEngine/Admin/Mods/delallymedalbyaid.php" method="POST" style="margin:0">
<?php echo csrf_field(); ?>
<input type="hidden" name="admid" value="<?=$_SESSION['id']?>">
<input type="hidden" name="aid" value="<?=$_GET['aid']?>">
<button type="submit" class="medal-del" title="Delete All">