diff options
| author | plegall <plg@piwigo.org> | 2009-12-19 20:49:03 +0000 |
|---|---|---|
| committer | plegall <plg@piwigo.org> | 2009-12-19 20:49:03 +0000 |
| commit | b1e62225963f1e3f22d7a64f845f9436a40e44ab (patch) | |
| tree | 9fcb51f2793c4edafc2f108b191634e427402418 /admin | |
| parent | d6e113952819905b66161a1ec09b5a88c84fd6d0 (diff) | |
bug 1328: implements check_pwg_token at site management level.
git-svn-id: http://piwigo.org/svn/branches/2.0@4531 68402e56-0260-453c-a942-63ccdbb3a9ee
Diffstat (limited to 'admin')
| -rw-r--r-- | admin/site_manager.php | 18 | ||||
| -rw-r--r-- | admin/template/goto/site_manager.tpl | 2 |
2 files changed, 15 insertions, 5 deletions
diff --git a/admin/site_manager.php b/admin/site_manager.php index 06687a274..7e30090d6 100644 --- a/admin/site_manager.php +++ b/admin/site_manager.php @@ -33,6 +33,11 @@ include_once(PHPWG_ROOT_PATH.'admin/include/functions.php'); // +-----------------------------------------------------------------------+ check_status(ACCESS_ADMINISTRATOR); +if (!empty($_POST) or isset($_GET['action'])) +{ + check_pwg_token(); +} + /** * requests the given $url (a remote create_listing_file.php) and fills a * list of lines corresponding to request output @@ -198,11 +203,13 @@ SELECT galleries_url } } -$template->assign( array( - 'U_HELP' => get_root_url().'popuphelp.php?page=site_manager', - 'F_ACTION' => get_root_url().'admin.php' - .get_query_string_diff( array('action','site') ) - ) ); +$template->assign( + array( + 'U_HELP' => get_root_url().'popuphelp.php?page=site_manager', + 'F_ACTION' => get_root_url().'admin.php'.get_query_string_diff(array('action','site','pwg_token')), + 'PWG_TOKEN' => get_pwg_token(), + ) + ); // +-----------------------------------------------------------------------+ // | remote sites list | @@ -242,6 +249,7 @@ while ($row = mysql_fetch_array($result)) $base_url = PHPWG_ROOT_PATH.'admin.php'; $base_url.= '?page=site_manager'; $base_url.= '&site='.$row['id']; + $base_url.= '&pwg_token='.get_pwg_token(); $base_url.= '&action='; $update_url = PHPWG_ROOT_PATH.'admin.php'; diff --git a/admin/template/goto/site_manager.tpl b/admin/template/goto/site_manager.tpl index 61c0157cf..570b0a15c 100644 --- a/admin/template/goto/site_manager.tpl +++ b/admin/template/goto/site_manager.tpl @@ -17,6 +17,7 @@ {'remote_site_local_found'|@translate} {$local_listing.URL} {if isset($local_listing.CREATE)} <form action="{$F_ACTION}" method="post"> + <input type="hidden" name="pwg_token" value="{$PWG_TOKEN}" /> <p> {'remote_site_local_create'|@translate}: <input type="hidden" name="no_check" value="1"/> @@ -64,6 +65,7 @@ {/if} <form action="{$F_ACTION}" method="post"> + <input type="hidden" name="pwg_token" value="{$PWG_TOKEN}" /> <p> <label for="galleries_url" >{'site_create'|@translate}</label> <input type="text" name="galleries_url" id="galleries_url" /> |