From e17bb3dec6f05cd8941ba2bb4dd70f7e1ac9512e Mon Sep 17 00:00:00 2001
From: Ferywir <65760459+Ferywir@users.noreply.github.com>
Date: Tue, 23 Jun 2026 16:01:20 +0200
Subject: [PATCH] fix(admin): verify CSRF token in maintenance admin Mods
 [#139] (#269)

---
 Admin/Templates/cleanban.tpl                       | 1 +
 Admin/Templates/deletion.tpl                       | 1 +
 Admin/Templates/maintenenceResetGold.tpl           | 1 +
 Admin/Templates/maintenenceResetPlus.tpl           | 1 +
 Admin/Templates/maintenenceResetPlusBonus.tpl      | 1 +
 GameEngine/Admin/Mods/cp.php                       | 6 ++++++
 GameEngine/Admin/Mods/delUser.php                  | 5 +++++
 GameEngine/Admin/Mods/giveResBonus.php             | 5 +++++
 GameEngine/Admin/Mods/mainteneceBan.php            | 5 +++++
 GameEngine/Admin/Mods/mainteneceCleanBanData.php   | 5 +++++
 GameEngine/Admin/Mods/mainteneceResetGold.php      | 5 +++++
 GameEngine/Admin/Mods/mainteneceResetPlus.php      | 5 +++++
 GameEngine/Admin/Mods/mainteneceResetPlusBonus.php | 5 +++++
 GameEngine/Admin/Mods/mainteneceUnban.php          | 5 +++++
 GameEngine/Admin/Mods/recalcWH.php                 | 5 +++++
 15 files changed, 56 insertions(+)

diff --git a/Admin/Templates/cleanban.tpl b/Admin/Templates/cleanban.tpl
index 3208514d..68f69f0b 100644
--- a/Admin/Templates/cleanban.tpl
+++ b/Admin/Templates/cleanban.tpl
@@ -30,6 +30,7 @@
 </style>
 
 <form action="../GameEngine/Admin/Mods/mainteneceCleanBanData.php" method="POST" onsubmit="return confirm('TRUNCATE banlist? This cannot be undone!')">
+<?php echo csrf_field(); ?>
 <input type="hidden" name="admid" value="<?=$_SESSION['id']?>">
 <div class="clean-card">
   <div class="clean-head">Clear – Banlist - Data</div>
diff --git a/Admin/Templates/deletion.tpl b/Admin/Templates/deletion.tpl
index e17059e9..0ed96d8b 100644
--- a/Admin/Templates/deletion.tpl
+++ b/Admin/Templates/deletion.tpl
@@ -78,6 +78,7 @@ if(isset($_GET['uid']) && (int)$_GET['uid'] > 0) {
     </div>
 
     <form action="../GameEngine/Admin/Mods/delUser.php" method="post" onsubmit="return confirm('ESTI SIGUR? Se va sterge tot: sate, trupe, rapoarte!')">
+        <?php echo csrf_field(); ?>
         <input type="hidden" name="uid" value="<?php echo $target['id']; ?>">
         <input type="hidden" name="admid" value="<?php echo $_SESSION['id']; ?>">
 
diff --git a/Admin/Templates/maintenenceResetGold.tpl b/Admin/Templates/maintenenceResetGold.tpl
index 3d2c1082..62b90679 100644
--- a/Admin/Templates/maintenenceResetGold.tpl
+++ b/Admin/Templates/maintenenceResetGold.tpl
@@ -55,6 +55,7 @@ if($_SESSION['access'] < ADMIN) die("Access Denied: You are not Admin!");
     </div>
 
     <form action="../GameEngine/Admin/Mods/mainteneceResetGold.php" method="POST" class="resetgold-form" onsubmit="return confirm('Are you SURE you want to reset gold to ALL players?');">
+      <?php echo csrf_field(); ?>
       <input type="hidden" name="admid" value="<?php echo $_SESSION['id']; ?>">
       <button type="submit">
         <svg width="18" height="18" viewBox="0 0 24 24" fill="none"><path d="M3 6h18M8 6V4h8v2m-1 0v14a2 2 0 0 1-2 2H9a2 2 0 0 1-2-2V6h10z" stroke="#fff" stroke-width="2" stroke-linecap="round"/></svg>
diff --git a/Admin/Templates/maintenenceResetPlus.tpl b/Admin/Templates/maintenenceResetPlus.tpl
index a2b07713..31d33e40 100644
--- a/Admin/Templates/maintenenceResetPlus.tpl
+++ b/Admin/Templates/maintenenceResetPlus.tpl
@@ -55,6 +55,7 @@ if($_SESSION['access'] < ADMIN) die("Access Denied: You are not Admin!");
     </div>
 
     <form action="../GameEngine/Admin/Mods/mainteneceResetPlus.php" method="POST" class="resetplus-form" onsubmit="return confirm('Are you SURE you want to reset the Plus to ALL players?');">
+      <?php echo csrf_field(); ?>
       <input type="hidden" name="admid" value="<?php echo $_SESSION['id']; ?>">
       <button type="submit">
         <svg width="18" height="18" viewBox="0 0 24 24" fill="none"><path d="M3 6h18M8 6V4h8v2m-1 0v14a2 2 0 0 1-2 2H9a2 2 0 0 1-2-2V6h10z" stroke="#fff" stroke-width="2" stroke-linecap="round"/></svg>
diff --git a/Admin/Templates/maintenenceResetPlusBonus.tpl b/Admin/Templates/maintenenceResetPlusBonus.tpl
index 2c37f892..eef5fdeb 100644
--- a/Admin/Templates/maintenenceResetPlusBonus.tpl
+++ b/Admin/Templates/maintenenceResetPlusBonus.tpl
@@ -67,6 +67,7 @@ if($_SESSION['access'] < ADMIN) die("Access Denied: You are not Admin!");
     </div>
 
     <form action="../GameEngine/Admin/Mods/mainteneceResetPlusBonus.php" method="POST" class="resetres-form" onsubmit="return confirm('Are you SURE you want to reset resource bonuses?');">
+      <?php echo csrf_field(); ?>
       <input type="hidden" name="admid" value="<?php echo $_SESSION['id']; ?>">
       <button type="submit">
         <svg width="18" height="18" viewBox="0 0 24 24" fill="none"><path d="M3 6h18M8 6V4h8v2m-1 0v14a2 2 0 0 1-2 2H9a2 2 0 0 1-2-2V6h10z" stroke="#fff" stroke-width="2" stroke-linecap="round"/></svg>
diff --git a/GameEngine/Admin/Mods/cp.php b/GameEngine/Admin/Mods/cp.php
index c186be2b..d7f0de1b 100755
--- a/GameEngine/Admin/Mods/cp.php
+++ b/GameEngine/Admin/Mods/cp.php
@@ -10,6 +10,12 @@
 #################################################################################
 if (!isset($_SESSION)) session_start();
 if($_SESSION['access'] < 9) die("Access Denied: You are not Admin!");
+
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../config.php");
 
 // go max 5 levels up - we don't have folders that go deeper than that
diff --git a/GameEngine/Admin/Mods/delUser.php b/GameEngine/Admin/Mods/delUser.php
index 28e375f6..c15dbed7 100644
--- a/GameEngine/Admin/Mods/delUser.php
+++ b/GameEngine/Admin/Mods/delUser.php
@@ -14,6 +14,11 @@ if (empty($_SESSION['access']) || $_SESSION['access'] < 9) {
     die("Access Denied: You are not Admin!");
 }
 
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../config.php");
 
 // ---------------------------------------------------------------------------
diff --git a/GameEngine/Admin/Mods/giveResBonus.php b/GameEngine/Admin/Mods/giveResBonus.php
index 1fd67ee4..f8cc0763 100755
--- a/GameEngine/Admin/Mods/giveResBonus.php
+++ b/GameEngine/Admin/Mods/giveResBonus.php
@@ -17,6 +17,11 @@ if (empty($_SESSION['access']) || $_SESSION['access'] < 9) {
     die("Access Denied: You are not Admin!");
 }
 
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../config.php");
 
 // ---------------------------------------------------------------------------
diff --git a/GameEngine/Admin/Mods/mainteneceBan.php b/GameEngine/Admin/Mods/mainteneceBan.php
index 622bd85b..808dde38 100755
--- a/GameEngine/Admin/Mods/mainteneceBan.php
+++ b/GameEngine/Admin/Mods/mainteneceBan.php
@@ -17,6 +17,11 @@ if (empty($_SESSION['access']) || $_SESSION['access'] < 9) {
     die("Access Denied: You are not Admin!");
 }
 
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../config.php");
 
 // ---------------------------------------------------------------------------
diff --git a/GameEngine/Admin/Mods/mainteneceCleanBanData.php b/GameEngine/Admin/Mods/mainteneceCleanBanData.php
index 52e6648a..93ff78f7 100755
--- a/GameEngine/Admin/Mods/mainteneceCleanBanData.php
+++ b/GameEngine/Admin/Mods/mainteneceCleanBanData.php
@@ -16,6 +16,11 @@ if (empty($_SESSION['access']) || $_SESSION['access'] < 9) {
     die("Access Denied: You are not Admin!");
 }
 
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../config.php");
 
 // ---------------------------------------------------------------------------
diff --git a/GameEngine/Admin/Mods/mainteneceResetGold.php b/GameEngine/Admin/Mods/mainteneceResetGold.php
index c899d66a..91119b7c 100755
--- a/GameEngine/Admin/Mods/mainteneceResetGold.php
+++ b/GameEngine/Admin/Mods/mainteneceResetGold.php
@@ -17,6 +17,11 @@ if (empty($_SESSION['access']) || $_SESSION['access'] < 9) {
     die("Access Denied: You are not Admin!");
 }
 
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../config.php");
 
 // ---------------------------------------------------------------------------
diff --git a/GameEngine/Admin/Mods/mainteneceResetPlus.php b/GameEngine/Admin/Mods/mainteneceResetPlus.php
index 6108d41b..6030bade 100755
--- a/GameEngine/Admin/Mods/mainteneceResetPlus.php
+++ b/GameEngine/Admin/Mods/mainteneceResetPlus.php
@@ -17,6 +17,11 @@ if (empty($_SESSION['access']) || $_SESSION['access'] < 9) {
     die("Access Denied: You are not Admin!");
 }
 
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../config.php");
 
 // ---------------------------------------------------------------------------
diff --git a/GameEngine/Admin/Mods/mainteneceResetPlusBonus.php b/GameEngine/Admin/Mods/mainteneceResetPlusBonus.php
index 414d4f75..3e923003 100755
--- a/GameEngine/Admin/Mods/mainteneceResetPlusBonus.php
+++ b/GameEngine/Admin/Mods/mainteneceResetPlusBonus.php
@@ -17,6 +17,11 @@ if (empty($_SESSION['access']) || $_SESSION['access'] < 9) {
     die("Access Denied: You are not Admin!");
 }
 
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../config.php");
 
 // ---------------------------------------------------------------------------
diff --git a/GameEngine/Admin/Mods/mainteneceUnban.php b/GameEngine/Admin/Mods/mainteneceUnban.php
index e0cfee06..9728c7b0 100755
--- a/GameEngine/Admin/Mods/mainteneceUnban.php
+++ b/GameEngine/Admin/Mods/mainteneceUnban.php
@@ -17,6 +17,11 @@ if (empty($_SESSION['access']) || $_SESSION['access'] < 9) {
     die("Access Denied: You are not Admin!");
 }
 
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../config.php");
 
 // ---------------------------------------------------------------------------
diff --git a/GameEngine/Admin/Mods/recalcWH.php b/GameEngine/Admin/Mods/recalcWH.php
index e95077ab..5c29ad86 100755
--- a/GameEngine/Admin/Mods/recalcWH.php
+++ b/GameEngine/Admin/Mods/recalcWH.php
@@ -17,6 +17,11 @@ if (empty($_SESSION['access']) || $_SESSION['access'] < 9) {
     die("Access Denied: You are not Admin!");
 }
 
+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../config.php");
 
 // ---------------------------------------------------------------------------