From c695136e4d75695178a9fc848a7cf6bfa2b9346c Mon Sep 17 00:00:00 2001 From: plegall Date: Fri, 19 Mar 2010 22:25:39 +0000 Subject: bug 1328: backport the pwg_token on trunk bug 1329: backport the check_input_parameter on trunk feature 1026: add pwg_token feature for edit/delete comment. Heavy refactoring on this feature to make the code simpler and easier to maintain (I hope). git-svn-id: http://piwigo.org/svn/trunk@5195 68402e56-0260-453c-a942-63ccdbb3a9ee --- admin/cat_list.php | 9 +++++++++ 1 file changed, 9 insertions(+) (limited to 'admin/cat_list.php') diff --git a/admin/cat_list.php b/admin/cat_list.php index 7168b3fd0..5aadeb3c2 100644 --- a/admin/cat_list.php +++ b/admin/cat_list.php @@ -33,6 +33,11 @@ include_once(PHPWG_ROOT_PATH.'admin/include/functions.php'); // +-----------------------------------------------------------------------+ check_status(ACCESS_ADMINISTRATOR); +if (!empty($_POST) or isset($_GET['delete'])) +{ + check_pwg_token(); +} + // +-----------------------------------------------------------------------+ // | functions | // +-----------------------------------------------------------------------+ @@ -64,6 +69,8 @@ function save_categories_order($categories) // | initialization | // +-----------------------------------------------------------------------+ +check_input_parameter('parent_id', $_GET, false, PATTERN_ID); + $categories = array(); $base_url = get_root_url().'admin.php?page=cat_list'; @@ -185,6 +192,7 @@ if (isset($_GET['parent_id'])) $template->assign(array( 'CATEGORIES_NAV'=>$navigation, 'F_ACTION'=>$form_action, + 'PWG_TOKEN' => get_pwg_token(), )); // +-----------------------------------------------------------------------+ @@ -260,6 +268,7 @@ foreach ($categories as $category) if (empty($category['dir'])) { $tpl_cat['U_DELETE'] = $self_url.'&delete='.$category['id']; + $tpl_cat['U_DELETE'].= '&pwg_token='.get_pwg_token(); } if ( array_key_exists($category['id'], $categories_with_images) ) -- cgit v1.2.3