xinyin025/TravianZ
1
0
Fork 0
mirror of https://github.com/Shadowss/TravianZ.git synced 2026-08-12 06:11:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(admin): verify CSRF token in player-management admin Mods [#139] (#256)

Browse Source
This commit is contained in:
Ferywir
2026-06-23 05:54:03 +02:00
committed by GitHub
parent 6888a09b5f
commit e49069a9c6
17 changed files with 55 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Admin/Templates/addUsers.tpl
+1
View File
@@ -103,6 +103,7 @@ elseif(isset($_GET['g']) && $_GET['g']=='OK'){
</div>
<form action="../GameEngine/Admin/Mods/addUsers.php" method="POST" class="add-form">
<?php echo csrf_field(); ?>
<input type="hidden" name="id" value="<?php echo $id;?>">
<?php if($errorMsg){?><div class="alert alert-err">✗ <?php echo $errorMsg;?></div><?php }?>
Admin/Templates/editAccess.tpl
+1
View File
@@ -28,6 +28,7 @@ if(isset($_GET['uid']))
?>
<form action="../GameEngine/Admin/Mods/editAccess.php" method="POST">
<?php echo csrf_field(); ?>
<input type="hidden" name="admid" id="admid" value="<?php echo $_SESSION['id']; ?>">
<input type="hidden" name="uid" id="uid" value="<?php echo $_GET['uid']; ?>">
<table id="member" style="width:300px;">
Admin/Templates/editAdditional.tpl
+1
View File
@@ -72,6 +72,7 @@ if(isset($id)) {
</div>
<form action="../GameEngine/Admin/Mods/additional.php" method="POST">
<?php echo csrf_field(); ?>
<input type="hidden" name="admid" value="<?php echo $_SESSION['id']; ?>">
<input type="hidden" name="id" value="<?php echo $id; ?>" />
Admin/Templates/editHero.tpl
+1
View File
@@ -132,6 +132,7 @@ function go_url(url){ location=url; return false; }
</div>
<form name="frmHero" action="../GameEngine/Admin/Mods/editHero.php" method="POST">
<?php echo csrf_field(); ?>
<input type="hidden" name="admid" value="<?php echo $_SESSION['id'];?>">
<input type="hidden" name="id" value="<?php echo $id;?>" />
<input type="hidden" name="hid" value="<?php echo $hid;?>" />
Admin/Templates/editPassword.tpl
+1
View File
@@ -75,6 +75,7 @@ function genPw(){
</div>
<form action="../GameEngine/Admin/Mods/editPassword.php" method="POST">
<?php echo csrf_field(); ?>
<input type="hidden" name="admid" value="<?php echo $_SESSION['id']; ?>">
<input type="hidden" name="uid" value="<?php echo $uid; ?>">
Admin/Templates/editProtection.tpl
+1
View File
@@ -74,6 +74,7 @@ function setDays(d){ document.getElementById('protect').value = d; }
</div>
<form action="../GameEngine/Admin/Mods/editProtection.php" method="POST">
<?php echo csrf_field(); ?>
<input type="hidden" name="admid" value="<?php echo $_SESSION['id']; ?>">
<input type="hidden" name="uid" value="<?php echo $uid; ?>">
<input type="hidden" name="id" value="<?php echo $id; ?>">
Admin/Templates/editSitter.tpl
+1
View File
@@ -69,6 +69,7 @@ function clearSitter(n){ document.getElementById('sit'+n).value = '0'; }
</div>
<form action="../GameEngine/Admin/Mods/editSitter.php" method="POST">
<?php echo csrf_field(); ?>
<input type="hidden" name="admid" value="<?php echo $_SESSION['id']; ?>">
<input type="hidden" name="uid" value="<?php echo $uid; ?>">
<input type="hidden" name="id" value="<?php echo $id; ?>">
Admin/Templates/editUser.tpl
+2
View File
@@ -84,6 +84,7 @@ select.dropdown { width:100%; }
<!-- USERNAME EDIT - NOU -->
<div class="username-row">
<form action="../GameEngine/Admin/Mods/editUsername.php" method="POST">
<?php echo csrf_field(); ?>
<input type="hidden" name="admid" value="<?php echo $_SESSION['id']; ?>">
<input type="hidden" name="uid" value="<?php echo $uid; ?>">
<div class="form-row">
@@ -96,6 +97,7 @@ select.dropdown { width:100%; }
<!-- RESTUL FORMULUI PRINCIPAL -->
<form action="../GameEngine/Admin/Mods/editUser.php" method="POST">
<?php echo csrf_field(); ?>
<input type="hidden" name="admid" value="<?php echo $_SESSION['id']; ?>">
<input type="hidden" name="uid" value="<?php echo $uid; ?>" />
<input type="hidden" name="id" value="<?php echo $id; ?>" />