fix(admin): wire CSRF token into admin.php-routed forms [#139] (#244)

Admin/Templates/add_village.tpl

@@ -57,6 +57,7 @@
 </style>
 
 <form method="post" action="admin.php" style="margin:0">
+<?php echo csrf_field(); ?>
 <input name="action" type="hidden" value="addVillage">
 <input name="uid" type="hidden" value="<?php echo $user['id'];?>">
 <table class="punish-box">

Admin/Templates/ban.tpl

@@ -121,6 +121,7 @@ $banHistory = mysqli_query($database->dblink,"SELECT * FROM ".TB_PREFIX."banlist
         Add New Ban
       </h3>
       <form method="post" class="ban-form">
+        <?php echo csrf_field(); ?>
         <input type="hidden" name="action" value="addBan">
         <div class="row">
           <input type="number" name="uid" placeholder="User ID" required>
@@ -174,6 +175,7 @@ $banHistory = mysqli_query($database->dblink,"SELECT * FROM ".TB_PREFIX."banlist
         Ban IP Address
       </h3>
       <form method="post" class="ban-form">
+        <?php echo csrf_field(); ?>
         <input type="hidden" name="action" value="addIpBan">
         <div class="row">
           <input type="text" name="ip" placeholder="IPv4 or IPv6" required>

Admin/Templates/maintenance.tpl

@@ -60,6 +60,7 @@ if($maint['started_by'] > 0){
 <?php if(!empty($error)) echo '<div class="msg">'.$error.'</div>'; ?>
 
 <form method="POST">
+<?php echo csrf_field(); ?>
 <div class="maint-card">
   <div class="maint-head">Server Maintenance</div>
   <div class="maint-status <?= $maint['active'] ? 'on' : 'off' ?>">

Admin/Templates/map.tpl

@@ -130,6 +130,7 @@ body{margin:0;background:#f1f5f9;font-family:system-ui,-apple-system,Segoe UI,Ro
   </div>
 
   <form id="show" action="admin.php?p=map" method="POST" class="map-filters">
+    <?php echo csrf_field(); ?>
     <div class="filter-group">
       <input id="show1" name="show1" type="checkbox" <?php echo $check1;?> value="1">
       <label for="show1">Players</label>

Admin/Templates/map_tile.tpl

@@ -69,7 +69,7 @@ function village_type_by_fieldtype_id($id){
 
 function gen_map_tiles_select_list_form($is_ocuppied,$is_oasis,$oasis_type,$fieldtype,$x,$y){
   $not_ocuppied =!$is_ocuppied;
-  $html = '<div class="tile-edit"><b>New Map Tile Type</b><form method="post" action="?p=map_tile&do_save"><select name="new_field_type" class="tile-select">';
+  $html = '<div class="tile-edit"><b>New Map Tile Type</b><form method="post" action="?p=map_tile&do_save">' . csrf_field() . '<select name="new_field_type" class="tile-select">';
   if($is_oasis){
     for($i=1;$i<13;$i++){ $sel=($i==$oasis_type)?' selected':''; $html.='<option value="'.$i.'_0"'.$sel.'>['.$i.'] Oasis '.oasis_type_by_id($i).'</option>'; }
     if($not_ocuppied){ for($i=1;$i<13;$i++){ $html.='<option value="'.$i.'_1">['.$i.'] Valley '.village_type_by_fieldtype_id($i).'</option>'; } }
@@ -158,6 +158,7 @@ elseif(isset($_GET['do_get']) && isset($_POST['x'])){
 
 <div class="tile-wrapper">
   <form class="tile-form" method="post" action="?p=map_tile&do_get">
+    <?php echo csrf_field(); ?>
     <div class="coord-wrap">
       <div class="coord-item">
         <b>X</b>

Admin/Templates/natars.tpl

@@ -57,6 +57,7 @@ $deletedArtifacts = $database->getDeletedArtifacts();
       <h2>🏰 WW Villages</h2>
       <div class="body">
         <form method="post" action="../Admin/admin.php?action=addWWVillages">
+          <?php echo csrf_field(); ?>
           <table class="nat-table">
             <tr><th>Number</th><th>Player ID</th><th></th></tr>
             <tr>
@@ -74,6 +75,7 @@ $deletedArtifacts = $database->getDeletedArtifacts();
       <h2>✨ Add Artifacts</h2>
       <div class="body">
         <form method="post" action="../Admin/admin.php?action=addArtifacts">
+          <?php echo csrf_field(); ?>
           <table class="nat-table">
             <tr><th>Icon</th><th>Type</th><th>Qty</th><th>Player</th><th></th></tr>
             <tr>

Admin/Templates/punish.tpl

@@ -57,6 +57,7 @@ $active = $admin->getUserActive();
 	<tbody>
 		<tr><td>
 			<form method="post" action="admin.php" style="margin:0">
+				<?php echo csrf_field(); ?>
 				<input type="hidden" name="action" value="punish">
 				<input type="hidden" name="uid" value="<?php echo $user['id'];?>">
 				<input type="hidden" name="admid" value="<?php echo $_SESSION['id']; ?>">
@@ -80,6 +81,7 @@ $active = $admin->getUserActive();
 		
 		<tr><td>
 			<form method="post" action="admin.php" style="margin:0">
+				<?php echo csrf_field(); ?>
 				<input type="hidden" name="action" value="punish">
 				<input type="hidden" name="uid" value="<?php echo $user['id'];?>">
 				<input type="hidden" name="admid" value="<?php echo $_SESSION['id']; ?>">
@@ -92,6 +94,7 @@ $active = $admin->getUserActive();
 		
 		<tr><td>
 			<form method="post" action="admin.php" style="margin:0">
+				<?php echo csrf_field(); ?>
 				<input type="hidden" name="action" value="punish">
 				<input type="hidden" name="uid" value="<?php echo $user['id'];?>">
 				<input type="hidden" name="admid" value="<?php echo $_SESSION['id']; ?>">

Admin/Templates/search.tpl

@@ -62,6 +62,7 @@ $search = stripslashes($_POST['s']?? '');
 
   <div class="search-card">
     <form action="" method="post" class="search-form" id="searchForm">
+      <?php echo csrf_field(); ?>
       <select name="p" id="searchType">
         <?php foreach($types as $k=>$v){?>
           <option value="<?php echo $k;?>" <?php echo $current==$k?'selected':'';?>><?php echo $v[1].' '.$v[0];?></option>

Admin/Templates/search2.tpl

@@ -43,6 +43,7 @@ foreach($varray as $vil) $totalpop += $vil['pop'];
 </style>
 
 <form action="" method="post">
+	<?php echo csrf_field(); ?>
 	<table id="member" class="search-modern">
 		<thead>
 			<tr>