aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
-rw-r--r--admin/site_manager.php18
-rw-r--r--admin/template/goto/site_manager.tpl2
2 files changed, 15 insertions, 5 deletions
diff --git a/admin/site_manager.php b/admin/site_manager.php
index 06687a274..7e30090d6 100644
--- a/admin/site_manager.php
+++ b/admin/site_manager.php
@@ -33,6 +33,11 @@ include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
// +-----------------------------------------------------------------------+
check_status(ACCESS_ADMINISTRATOR);
+if (!empty($_POST) or isset($_GET['action']))
+{
+ check_pwg_token();
+}
+
/**
* requests the given $url (a remote create_listing_file.php) and fills a
* list of lines corresponding to request output
@@ -198,11 +203,13 @@ SELECT galleries_url
}
}
-$template->assign( array(
- 'U_HELP' => get_root_url().'popuphelp.php?page=site_manager',
- 'F_ACTION' => get_root_url().'admin.php'
- .get_query_string_diff( array('action','site') )
- ) );
+$template->assign(
+ array(
+ 'U_HELP' => get_root_url().'popuphelp.php?page=site_manager',
+ 'F_ACTION' => get_root_url().'admin.php'.get_query_string_diff(array('action','site','pwg_token')),
+ 'PWG_TOKEN' => get_pwg_token(),
+ )
+ );
// +-----------------------------------------------------------------------+
// | remote sites list |
@@ -242,6 +249,7 @@ while ($row = mysql_fetch_array($result))
$base_url = PHPWG_ROOT_PATH.'admin.php';
$base_url.= '?page=site_manager';
$base_url.= '&site='.$row['id'];
+ $base_url.= '&pwg_token='.get_pwg_token();
$base_url.= '&action=';
$update_url = PHPWG_ROOT_PATH.'admin.php';
diff --git a/admin/template/goto/site_manager.tpl b/admin/template/goto/site_manager.tpl
index 61c0157cf..570b0a15c 100644
--- a/admin/template/goto/site_manager.tpl
+++ b/admin/template/goto/site_manager.tpl
@@ -17,6 +17,7 @@
{'remote_site_local_found'|@translate} {$local_listing.URL}
{if isset($local_listing.CREATE)}
<form action="{$F_ACTION}" method="post">
+ <input type="hidden" name="pwg_token" value="{$PWG_TOKEN}" />
<p>
{'remote_site_local_create'|@translate}:
<input type="hidden" name="no_check" value="1"/>
@@ -64,6 +65,7 @@
{/if}
<form action="{$F_ACTION}" method="post">
+ <input type="hidden" name="pwg_token" value="{$PWG_TOKEN}" />
<p>
<label for="galleries_url" >{'site_create'|@translate}</label>
<input type="text" name="galleries_url" id="galleries_url" />