allerta-vvf
/
allerta-vvf
mirror of https://github.com/allerta-vvf/allerta-vvf
1
0
Fork 0
Code Issues Releases Wiki Activity

csfr token in List

This commit is contained in:
Matteo Gheza 2020-09-26 16:58:02 +02:00
parent 69eb83fcfb
commit 425c30f5af
6 changed files with 11 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
server/list.php
View File

@ -1,4 +1,7 @@
<?php
require_once 'ui.php';
loadtemplate('list.html', ['title' => t("Availability List",false)]);
bdump($_SESSION);
if(!isset($_GET["_tracy_bar"])){
$_SESSION["token_list"] = bin2hex(random_bytes(64));
}
loadtemplate('list.html', ['title' => t("Availability List",false), 'token_list' => $_SESSION['token_list']]);
bdump($_SESSION);

4
server/risorse/ajax/ajax_aggiornadispo.php
View File

@ -2,10 +2,10 @@
include_once '../../core.php';
init_class();
$user->requirelogin();
if(isset($_POST["change_id"]) && $_POST["dispo"] == 1){
if(isset($_POST["change_id"]) && $_POST["dispo"] == 1 && $_POST["token_list"] == $_SESSION['token_list']){
$risultato = $database->exec("UPDATE `%PREFIX%_profiles` SET `available` = '1' WHERE `%PREFIX%_profiles`.`id` = :id;", false, [":id" => $_POST["change_id"]]);
$user->log("Attivazione disponibilita'", $_POST["change_id"], $user->auth->getUserId(), date("d/m/Y"), date("H:i.s"));
} else if(isset($_POST["change_id"]) && $_POST["dispo"] == 0){
} else if(isset($_POST["change_id"]) && $_POST["dispo"] == 0 && $_POST["token_list"] == $_SESSION['token_list']){
$risultato = $database->exec("UPDATE `%PREFIX%_profiles` SET `available` = '0' WHERE `%PREFIX%_profiles`.`id` = :id;", false, [":id" => $_POST["change_id"]]);
$user->log("Rimozione disponibilita'", $_POST["change_id"], $user->auth->getUserId(), date("d/m/Y"), date("H:i.s"));
}

3
server/templates/edit_service.html
View File

@ -303,9 +303,6 @@ $( ".tipi" ).val('{{ values.tipo }}');
$('#note').val('{{ values.note }}');
//{% endif %}
$('form').submit(function () {
if(!$('#token').val().endsWith("dJN299u49")){
$('#token').val($('#token').val() + "");
}
var progressivo_valido = /^[0-9/]{3,6}$/
var progressivo = $('#progressivo').val();
if(!progressivo_valido.test(progressivo)){

6
server/templates/edit_training.html
View File

@ -276,12 +276,6 @@ $.each('{{ values.personale|striptags|e("js") }}'.split(','), function( index, v
});
$('#note').val('{{ values.note|e("js") }}');
//{% endif %}
$('form').submit(function () {
if(!$('#token').val().endsWith("dJN299u49")){
$('#token').val($('#token').val() + "");
}
return true;
});
</script>
{% endif %}
{% if training.modalità == "delete" %}

8
server/templates/edit_user.html
View File

@ -250,14 +250,6 @@ textarea {
<button type="submit">{{ 'Submit'|t }}</button>
</div>
</form>
<script>
$('form').submit(function () {
if(!$('#token').val().endsWith("dJN299u49")){
$('#token').val($('#token').val() + "");
}
return true;
});
</script>
{% endif %}
{% if modalità == "delete" %}
<style>

6
server/templates/list.html
View File

@ -15,7 +15,8 @@
method: "POST",
data: {
change_id: id,
dispo: 1
dispo: 1,
token_list: "{{ token_list }}"
},
success: function(data) {
alert("{{ 'Thanks, %s, you have given your availability in case of alert.'|t|format(user.name) }}");
@ -30,7 +31,8 @@
method: "POST",
data: {
change_id: id,
dispo: 0
dispo: 0,
token_list: "{{ token_list }}"
},
success: function(data) {
alert("{{ 'Thanks, %s, you have removed your availability in case of alert.'|t|format(user.name) }}");