From f2fa6c16d92bbf36820645cc6a39d2a128f572fc Mon Sep 17 00:00:00 2001
From: plegall <plg@piwigo.org>
Date: Wed, 16 Dec 2009 21:48:09 +0000
Subject: bug 1328: check_pwg_token implemented on admin/cat_list forms
 (+delete action)

git-svn-id: http://piwigo.org/svn/branches/2.0@4505 68402e56-0260-453c-a942-63ccdbb3a9ee
---
 admin/cat_list.php               | 7 +++++++
 admin/template/goto/cat_list.tpl | 2 ++
 2 files changed, 9 insertions(+)

diff --git a/admin/cat_list.php b/admin/cat_list.php
index 43403e4f9..1aac22f0d 100644
--- a/admin/cat_list.php
+++ b/admin/cat_list.php
@@ -33,6 +33,11 @@ include_once(PHPWG_ROOT_PATH.'admin/include/functions.php');
 // +-----------------------------------------------------------------------+
 check_status(ACCESS_ADMINISTRATOR);
 
+if (!empty($_POST) or isset($_GET['delete']))
+{
+  check_pwg_token();
+}
+
 // +-----------------------------------------------------------------------+
 // |                               functions                               |
 // +-----------------------------------------------------------------------+
@@ -163,6 +168,7 @@ if (isset($_GET['parent_id']))
 $template->assign(array(
   'CATEGORIES_NAV'=>$navigation,
   'F_ACTION'=>$form_action,
+  'PWG_TOKEN' => get_pwg_token(),
  ));
 
 // +-----------------------------------------------------------------------+
@@ -238,6 +244,7 @@ foreach ($categories as $category)
   if (empty($category['dir']))
   {
     $tpl_cat['U_DELETE'] = $self_url.'&amp;delete='.$category['id'];
+    $tpl_cat['U_DELETE'].= '&amp;pwg_token='.get_pwg_token();
   }
 
   if ( array_key_exists($category['id'], $categories_with_images) )
diff --git a/admin/template/goto/cat_list.tpl b/admin/template/goto/cat_list.tpl
index f4e39a068..7654a2345 100644
--- a/admin/template/goto/cat_list.tpl
+++ b/admin/template/goto/cat_list.tpl
@@ -27,6 +27,7 @@
 <h3>{$CATEGORIES_NAV}</h3>
 
 <form id="addVirtual" action="{$F_ACTION}" method="post">
+  <input type="hidden" name="pwg_token" value="{$PWG_TOKEN}" />
   <p>
     {'cat_add'|@translate} : <input type="text" name="virtual_name" />
     <input class="submit" type="submit" value="{'Submit'|@translate}" name="submitAdd" {$TAG_INPUT_ENABLED} />
@@ -39,6 +40,7 @@
 
 {if count($categories) }
 <form id="categoryOrdering" action="{$F_ACTION}" method="post">
+  <input type="hidden" name="pwg_token" value="{$PWG_TOKEN}" />
   <p>
     <input class="submit" name="submitOrder" type="submit" value="{'Save order'|@translate}" {$TAG_INPUT_ENABLED} />
     <input class="submit" name="submitOrderAlphaNum" type="submit" value="{'Order alphanumerically'|@translate}" {$TAG_INPUT_ENABLED} />
-- 
cgit v1.2.3