diff options
| author | plegall <plg@piwigo.org> | 2009-12-16 21:48:09 +0000 |
|---|---|---|
| committer | plegall <plg@piwigo.org> | 2009-12-16 21:48:09 +0000 |
| commit | f2fa6c16d92bbf36820645cc6a39d2a128f572fc (patch) | |
| tree | c9a71b2cb7677e62e8676a9a8870017a6042686b /admin | |
| parent | 54ed1bfcdb463c931c190045a65438931ebd9cff (diff) | |
bug 1328: check_pwg_token implemented on admin/cat_list forms (+delete action)
git-svn-id: http://piwigo.org/svn/branches/2.0@4505 68402e56-0260-453c-a942-63ccdbb3a9ee
Diffstat (limited to '')
| -rw-r--r-- | admin/cat_list.php | 7 | ||||
| -rw-r--r-- | admin/template/goto/cat_list.tpl | 2 |
2 files changed, 9 insertions, 0 deletions
diff --git a/admin/cat_list.php b/admin/cat_list.php index 43403e4f9..1aac22f0d 100644 --- a/admin/cat_list.php +++ b/admin/cat_list.php @@ -33,6 +33,11 @@ include_once(PHPWG_ROOT_PATH.'admin/include/functions.php'); // +-----------------------------------------------------------------------+ check_status(ACCESS_ADMINISTRATOR); +if (!empty($_POST) or isset($_GET['delete'])) +{ + check_pwg_token(); +} + // +-----------------------------------------------------------------------+ // | functions | // +-----------------------------------------------------------------------+ @@ -163,6 +168,7 @@ if (isset($_GET['parent_id'])) $template->assign(array( 'CATEGORIES_NAV'=>$navigation, 'F_ACTION'=>$form_action, + 'PWG_TOKEN' => get_pwg_token(), )); // +-----------------------------------------------------------------------+ @@ -238,6 +244,7 @@ foreach ($categories as $category) if (empty($category['dir'])) { $tpl_cat['U_DELETE'] = $self_url.'&delete='.$category['id']; + $tpl_cat['U_DELETE'].= '&pwg_token='.get_pwg_token(); } if ( array_key_exists($category['id'], $categories_with_images) ) diff --git a/admin/template/goto/cat_list.tpl b/admin/template/goto/cat_list.tpl index f4e39a068..7654a2345 100644 --- a/admin/template/goto/cat_list.tpl +++ b/admin/template/goto/cat_list.tpl @@ -27,6 +27,7 @@ <h3>{$CATEGORIES_NAV}</h3> <form id="addVirtual" action="{$F_ACTION}" method="post"> + <input type="hidden" name="pwg_token" value="{$PWG_TOKEN}" /> <p> {'cat_add'|@translate} : <input type="text" name="virtual_name" /> <input class="submit" type="submit" value="{'Submit'|@translate}" name="submitAdd" {$TAG_INPUT_ENABLED} /> @@ -39,6 +40,7 @@ {if count($categories) } <form id="categoryOrdering" action="{$F_ACTION}" method="post"> + <input type="hidden" name="pwg_token" value="{$PWG_TOKEN}" /> <p> <input class="submit" name="submitOrder" type="submit" value="{'Save order'|@translate}" {$TAG_INPUT_ENABLED} /> <input class="submit" name="submitOrderAlphaNum" type="submit" value="{'Order alphanumerically'|@translate}" {$TAG_INPUT_ENABLED} /> |