makary/phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-06-08 04:18:52 +00:00
Code Issues Projects Releases Packages Wiki Activity

[ticket/16207] Add form keys to actions in MCP

Browse source 
PHPBB3-16207
This commit is contained in:
Marc Alexander 2019-11-10 17:53:27 +01:00
parent 32543c40ba
commit ee1cb783cb
No known key found for this signature in database
GPG key ID: 50E0D2423696F995
2 changed files with 15 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
phpBB/includes/mcp/mcp_forum.php
View file

@ -50,10 +50,17 @@ function mcp_forum_view($id, $mode, $action, $forum_info)
$url = append_sid("{$phpbb_root_path}mcp.$phpEx?$url_extra"); $url = append_sid("{$phpbb_root_path}mcp.$phpEx?$url_extra");
add_form_key('mcp_forum');
// Resync Topics // Resync Topics
switch ($action) switch ($action)
{ {
case 'resync': case 'resync':
if (!check_form_key('mcp_forum'))
{
trigger_error('FORM_INVALID');
}
$topic_ids = $request->variable('topic_id_list', array(0)); $topic_ids = $request->variable('topic_id_list', array(0));
mcp_resync_topics($topic_ids); mcp_resync_topics($topic_ids);
break; break;

9
phpBB/includes/mcp/mcp_topic.php
View file

@ -55,9 +55,16 @@ function mcp_topic_view($id, $mode, $action)
$submitted_id_list = $request->variable('post_ids', array(0)); $submitted_id_list = $request->variable('post_ids', array(0));
$checked_ids = $post_id_list = $request->variable('post_id_list', array(0)); $checked_ids = $post_id_list = $request->variable('post_id_list', array(0));
add_form_key('mcp_topic');
// Resync Topic? // Resync Topic?
if ($action == 'resync') if ($action == 'resync')
{ {
if (!check_form_key('mcp_topic'))
{
trigger_error('FORM_INVALID');
}
if (!function_exists('mcp_resync_topics')) if (!function_exists('mcp_resync_topics'))
{ {
include($phpbb_root_path . 'includes/mcp/mcp_forum.' . $phpEx); include($phpbb_root_path . 'includes/mcp/mcp_forum.' . $phpEx);
@ -90,7 +97,7 @@ function mcp_topic_view($id, $mode, $action)
$subject = $topic_info['topic_title']; $subject = $topic_info['topic_title'];
} }
// Restore or pprove posts? // Restore or approve posts?
if (($action == 'restore' || $action == 'approve') && $auth->acl_get('m_approve', $topic_info['forum_id'])) if (($action == 'restore' || $action == 'approve') && $auth->acl_get('m_approve', $topic_info['forum_id']))
{ {
if (!class_exists('mcp_queue')) if (!class_exists('mcp_queue'))