From 3c140b0f3b4742ca3679ee4cc787ef90358fee9b Mon Sep 17 00:00:00 2001
From: fredtempez <ftempez@gmail.com>
Date: Wed, 16 Jan 2019 16:56:18 +0100
Subject: [PATCH] Faille CRSF dans la galerie

---
 module/gallery/gallery.php | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/module/gallery/gallery.php b/module/gallery/gallery.php
index 07a5b3a1..c75acb46 100755
--- a/module/gallery/gallery.php
+++ b/module/gallery/gallery.php
@@ -54,12 +54,12 @@ class gallery extends common {
 					$gallery['config']['name'],
 					$gallery['config']['directory'],
 					template::button('galleryConfigEdit' . $galleryId, [
-						'href' => helper::baseUrl() . $this->getUrl(0) . '/edit/' . $galleryId,
+						'href' => helper::baseUrl() . $this->getUrl(0) . '/edit/' . $galleryId  . '/' . $_SESSION['csrf'],
 						'value' => template::ico('pencil')
 					]),
 					template::button('galleryConfigDelete' . $galleryId, [
 						'class' => 'galleryConfigDelete buttonRed',
-						'href' => helper::baseUrl() . $this->getUrl(0) . '/delete/' . $galleryId. '&csrf=' . $_SESSION['csrf'],
+						'href' => helper::baseUrl() . $this->getUrl(0) . '/delete/' . $galleryId . '/' . $_SESSION['csrf'],
 						'value' => template::ico('cancel')
 					])
 				];
@@ -93,33 +93,25 @@ class gallery extends common {
 	 * Suppression
 	 */
 	public function delete() {
-		// $url prend l'adresse sans le token
-		$url = explode('&',$this->getUrl(2));		
+		// $url prend l'adresse sans le token	
 		// La galerie n'existe pas
-		if($this->getData(['module', $this->getUrl(0), $url[0]]) === null) {
+		if($this->getData(['module', $this->getUrl(0), $this->getUrl(2)]) === null) {
 			// Valeurs en sortie
 			$this->addOutput([
 				'access' => false
 			]);
 		}
 		// Jeton incorrect
-		elseif(!isset($_GET['csrf'])) {
-			// Valeurs en sortie
-			$this->addOutput([
-				'redirect' => helper::baseUrl() . 'config',
-				'notification' => 'Jeton invalide'
-			]);
-		}
 		elseif ($_GET['csrf'] !== $_SESSION['csrf']) {
 			// Valeurs en sortie
 			$this->addOutput([
-				'redirect' => helper::baseUrl() . 'config',
+				'redirect' => helper::baseUrl() . $this->getUrl(0)  . '/config',
 				'notification' => 'Suppression non autorisée'
 			]);
 		}		
 		// Suppression
 		else {
-			$this->deleteData(['module', $this->getUrl(0), $url[0]]);
+			$this->deleteData(['module', $this->getUrl(0), $this->getUrl(2)]);
 			// Valeurs en sortie
 			$this->addOutput([
 				'redirect' => helper::baseUrl() . $this->getUrl(0) . '/config',
@@ -144,6 +136,14 @@ class gallery extends common {
 	 * Édition
 	 */
 	public function edit() {
+		// Jeton incorrect
+		if ($this->getUrl(3) !== $_SESSION['csrf']) {
+			// Valeurs en sortie
+			$this->addOutput([
+				'redirect' => helper::baseUrl() . $this->getUrl(0) . '/config',
+				'notification' => 'Action  non autorisée'
+			]);
+		}			
 		// La galerie n'existe pas
 		if($this->getData(['module', $this->getUrl(0), $this->getUrl(2)]) === null) {
 			// Valeurs en sortie