xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-06-28 00:24:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(admin): verify CSRF token in troop admin Mods [#139] (#258)

Browse Source 
addTroops and addABTroops are POSTed to directly, bypassing admin.php's
central csrf_verify(). Add csrf_verify() (after the admin access check, via
the shared GameEngine/Admin/csrf.php) and csrf_field() in their forms.

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Ferywir
2026-06-23 07:43:18 +02:00
committed by GitHub
parent b880622fd1
commit 8d1a1cab38
4 changed files with 12 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Admin/Templates/addABTroops.tpl
+1
View File
@@ -53,6 +53,7 @@ if(isset($id)){
<div class="ab-wrap">
<form action="../GameEngine/Admin/Mods/addABTroops.php" method="POST">
<?php echo csrf_field(); ?>
<input type="hidden" name="id" value="<?php echo $_GET['did']; ?>">
<input type="hidden" name="admid" value="<?php echo $_SESSION['id']; ?>">
Admin/Templates/addTroops.tpl
+1
View File
@@ -55,6 +55,7 @@ if(isset($id)){
<div class="addtroops-wrap">
<form action="../GameEngine/Admin/Mods/addTroops.php" method="POST">
<?php echo csrf_field(); ?>
<input type="hidden" name="id" value="<?php echo $_GET['did']; ?>">
<input type="hidden" name="admid" value="<?php echo $_SESSION['id']; ?>">
GameEngine/Admin/Mods/addABTroops.php
+5
View File
@@ -17,6 +17,11 @@ if (empty($_SESSION['access']) || $_SESSION['access'] < 9) {
die("Access Denied: You are not Admin!");
}
// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
// itself (it does not go through admin.php's central csrf_verify()).
require_once(__DIR__ . '/../csrf.php');
csrf_verify();
include_once __DIR__ . "/../../Database.php";
/* ---------------------------------------------------------------------------
GameEngine/Admin/Mods/addTroops.php
+5
View File
@@ -19,6 +19,11 @@ if (empty($_SESSION['access']) || $_SESSION['access'] < 9) {
die(defined('ACCESS_DENIED_ADMIN') ? ACCESS_DENIED_ADMIN : 'Access Denied: You are not Admin!');
}
// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
// itself (it does not go through admin.php's central csrf_verify()).
require_once(__DIR__ . '/../csrf.php');
csrf_verify();
include_once __DIR__ . "/../../Database.php";
include_once __DIR__ . "/../../Technology.php";
include_once __DIR__ . "/../../Data/unitdata.php";