|
@@ 522-530 (lines=9) @@
|
| 519 |
|
|
| 520 |
|
// check CSRF for non-GET actions |
| 521 |
|
$use_check_csrf = isset($xml_info->action->{$this->act}) && $xml_info->action->{$this->act}->check_csrf !== 'false'; |
| 522 |
|
if($use_check_csrf && $_SERVER['REQUEST_METHOD'] !== 'GET' && Context::isInstalled() && !checkCSRF()) |
| 523 |
|
{ |
| 524 |
|
$this->error = 'msg_invalid_request'; |
| 525 |
|
$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode); |
| 526 |
|
$oMessageObject->setError(-1); |
| 527 |
|
$oMessageObject->setMessage($this->error); |
| 528 |
|
$oMessageObject->dispMessage(); |
| 529 |
|
return $oMessageObject; |
| 530 |
|
} |
| 531 |
|
|
| 532 |
|
// Admin ip |
| 533 |
|
if($kind == 'admin' && $_SESSION['denied_admin'] == 'Y') |
|
@@ 646-654 (lines=9) @@
|
| 643 |
|
|
| 644 |
|
// check CSRF for non-GET actions |
| 645 |
|
$use_check_csrf = isset($xml_info->action->{$this->act}) && $xml_info->action->{$this->act}->check_csrf !== 'false'; |
| 646 |
|
if($use_check_csrf && $_SERVER['REQUEST_METHOD'] !== 'GET' && Context::isInstalled() && !checkCSRF()) |
| 647 |
|
{ |
| 648 |
|
$this->error = 'msg_invalid_request'; |
| 649 |
|
$oMessageObject = ModuleHandler::getModuleInstance('message', $display_mode); |
| 650 |
|
$oMessageObject->setError(-1); |
| 651 |
|
$oMessageObject->setMessage($this->error); |
| 652 |
|
$oMessageObject->dispMessage(); |
| 653 |
|
return $oMessageObject; |
| 654 |
|
} |
| 655 |
|
|
| 656 |
|
// SECISSUE also check foward act method |
| 657 |
|
// check REQUEST_METHOD in controller |