fix(admin): verify CSRF token in player-management admin Mods [#139] (#256)

2026-09-17 15:47:16 +00:00 · 2026-06-23 05:54:03 +02:00
parent 6888a09b5f
commit e49069a9c6
17 changed files with 55 additions and 0 deletions
@@ -132,6 +132,7 @@ function go_url(url){ location=url; return false; }
    </div>

 <form name="frmHero" action="../GameEngine/Admin/Mods/editHero.php" method="POST">
+    <?php echo csrf_field(); ?>
    <input type="hidden" name="admid" value="<?php echo $_SESSION['id'];?>">
    <input type="hidden" name="id" value="<?php echo $id;?>" />
    <input type="hidden" name="hid" value="<?php echo $hid;?>" />