fix(admin): verify CSRF token in maintenance admin Mods [#139] (#269)

2026-07-02 02:24:21 +00:00 · 2026-06-23 16:01:20 +02:00
parent 886f421f50
commit e17bb3dec6
15 changed files with 56 additions and 0 deletions
@@ -16,6 +16,11 @@ if (empty($_SESSION['access']) || $_SESSION['access'] < 9) {
    die("Access Denied: You are not Admin!");
 }

+// Issue #139: this Mod is POSTed to directly, so it must verify the CSRF token
+// itself (it does not go through admin.php's central csrf_verify()).
+require_once(__DIR__ . '/../csrf.php');
+csrf_verify();
+
 include_once("../../config.php");

 // ---------------------------------------------------------------------------