mirror/php-phpbb
1
0
Fork 0
mirror of https://github.com/phpbb/phpbb.git synced 2025-08-21 16:01:40 +02:00
Code Issues Releases Wiki Activity

Merge branch '3.1.x' into 3.2.x

Browse Source 
* 3.1.x:
  [ticket/14789] Add form tokens to tests and uncomment add_form_key
  [ticket/14789] Add link hashes and form tokens to all acp links/buttons
This commit is contained in:
Tristan Darricau
2016-09-18 21:14:47 +02:00
parent 47d2f34a1b bc08813866
commit 19bbbfe0f3
9 changed files with 118 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
phpBB/includes/acp/acp_icons.php
View File

@@ -40,6 +40,15 @@ class acp_icons
$action = (isset($_POST['edit'])) ? 'edit' : $action;
$action = (isset($_POST['import'])) ? 'import' : $action;
$icon_id = $request->variable('id', 0);
$submit = $request->is_set_post('submit', false);
$form_key = 'acp_icons';
add_form_key($form_key);
if ($submit && !check_form_key($form_key))
{
trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
}
$mode = ($mode == 'smilies') ? 'smilies' : 'icons';
@@ -822,6 +831,11 @@ class acp_icons
case 'move_up':
case 'move_down':
if (!check_link_hash($request->variable('hash', ''), 'acp_icons'))
{
trigger_error($user->lang['FORM_INVALID'] . adm_back_link($this->u_action), E_USER_WARNING);
}
// Get current order id...
$sql = "SELECT {$fields}_order as current_order
FROM $table
@@ -941,8 +955,8 @@ class acp_icons
'EMOTION' => (isset($row['emotion'])) ? $row['emotion'] : '',
'U_EDIT' => $this->u_action . '&action=edit&id=' . $row[$fields . '_id'],
'U_DELETE' => $this->u_action . '&action=delete&id=' . $row[$fields . '_id'],
'U_MOVE_UP' => $this->u_action . '&action=move_up&id=' . $row[$fields . '_id'] . '&start=' . $pagination_start,
'U_MOVE_DOWN' => $this->u_action . '&action=move_down&id=' . $row[$fields . '_id'] . '&start=' . $pagination_start,
'U_MOVE_UP' => $this->u_action . '&action=move_up&id=' . $row[$fields . '_id'] . '&start=' . $pagination_start . '&hash=' . generate_link_hash('acp_icons'),
'U_MOVE_DOWN' => $this->u_action . '&action=move_down&id=' . $row[$fields . '_id'] . '&start=' . $pagination_start . '&hash=' . generate_link_hash('acp_icons'),
));
if (!$spacer && !$row['display_on_posting'])