ZwiiCMS-Team/ZwiiCMS
ZwiiCMS-Team/ZwiiCMS
10
9
Fork 3
Code Releases 156 Activity

csrf user

Browse Source
This commit is contained in:
Fred Tempez 2023-06-20 20:24:15 +02:00
parent 43b084369e
commit 8397e5eb0c
1 changed files with 7 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
core/module/user/user.php
View File

@ -157,11 +157,13 @@ class user extends common
]); ]);
} }
// Jeton incorrect // Jeton incorrect
elseif ($this->getUrl(3) !== $_SESSION['csrf']) { elseif (
$this->checkCSRF()
) {
// Valeurs en sortie // Valeurs en sortie
$this->addOutput([ $this->addOutput([
'redirect' => helper::baseUrl() . 'user', 'redirect' => helper::baseUrl() . 'user',
'notification' => helper::translate('Action interdite') 'notification' => helper::translate('Jeton incorrect')
]); ]);
} }
// Bloque la suppression de son propre compte // Bloque la suppression de son propre compte
@ -190,7 +192,7 @@ class user extends common
public function edit() public function edit()
{ {
if ( if (
$this->getUrl(3) !== $_SESSION['csrf'] $this->checkCSRF()
) { ) {
// Valeurs en sortie // Valeurs en sortie
@ -375,13 +377,13 @@ class user extends common
$userFirstname . ' ' . $this->getData(['user', $userId, 'lastname']), $userFirstname . ' ' . $this->getData(['user', $userId, 'lastname']),
helper::translate(self::$groups[$this->getData(['user', $userId, 'group'])]), helper::translate(self::$groups[$this->getData(['user', $userId, 'group'])]),
template::button('userEdit' . $userId, [ template::button('userEdit' . $userId, [
'href' => helper::baseUrl() . 'user/edit/' . $userId , 'href' => helper::baseUrl() . 'user/edit/' . $userId,
'value' => template::ico('pencil'), 'value' => template::ico('pencil'),
'help' => 'Éditer' 'help' => 'Éditer'
]), ]),
template::button('userDelete' . $userId, [ template::button('userDelete' . $userId, [
'class' => 'userDelete buttonRed', 'class' => 'userDelete buttonRed',
'href' => helper::baseUrl() . 'user/delete/' . $userId , 'href' => helper::baseUrl() . 'user/delete/' . $userId,
'value' => template::ico('trash'), 'value' => template::ico('trash'),
'help' => 'Supprimer' 'help' => 'Supprimer'
]) ])