mirror/php-monstra
1
0
Fork 0
mirror of https://github.com/monstra-cms/monstra.git synced 2025-08-06 13:16:54 +02:00
Code Issues Releases Wiki Activity

Backup Plugin: csrf vulnerability resolved

Browse Source
This commit is contained in:
Awilum
2012-10-03 13:46:00 +03:00
parent d36c06d8a6
commit 3f7b10592f
2 changed files with 29 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
plugins/box/backup/views/backend/index.view.php Normal file → Executable file
View File

@@ -10,6 +10,7 @@ $().ready(function(){$('[name=create_backup]').click(function(){$(this).button('
<?php
echo (
Form::open() .
Form::hidden('csrf', Security::token()).
Form::checkbox('add_storage_folder', null, true, array('disabled' => 'disabled')) . ' ' . __('storage', 'backup') . ' ' . Html::nbsp(2) .
Form::checkbox('add_public_folder') . ' ' . __('public', 'backup') . ' ' . Html::nbsp(2) .
Form::checkbox('add_plugins_folder') . ' ' . __('plugins', 'backup') . ' ' . Html::nbsp(2) .
@@ -32,12 +33,12 @@ $().ready(function(){$('[name=create_backup]').click(function(){$(this).button('
<tr>
<td>
<?php $name = strtotime(str_replace('-', '', basename($backup, '.zip'))); ?>
<?php echo Html::anchor(Date::format($name, 'F jS, Y - g:i A'), Option::get('siteurl').'admin/index.php?id=backup&download='.$backup); ?>
<?php echo Html::anchor(Date::format($name, 'F jS, Y - g:i A'), Option::get('siteurl').'admin/index.php?id=backup&download='.$backup.'&token='.Security::token()); ?>
</td>
<td><?php echo Number::byteFormat(filesize(ROOT . DS . 'backups' . DS . $backup)); ?></td>
<td>
<?php echo Html::anchor(__('Delete', 'backup'),
'index.php?id=system&sub_id=backup&delete_file='.$backup,
'index.php?id=system&sub_id=backup&delete_file='.$backup.'&token='.Security::token(),
array('class' => 'btn btn-actions', 'onclick' => "return confirmDelete('".__('Delete backup: :backup', 'backup', array(':backup' => Date::format($name, 'F jS, Y - g:i A')))."')"));
?>
</td>