lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix missing token

Browse Source
This commit is contained in:
Laurent Destailleur 2020-09-28 16:33:27 +02:00
parent b61815e95f
commit 1a28d7f641
2 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
htdocs/core/lib/ticket.lib.php
View File

@ -431,6 +431,7 @@ function show_ticket_messaging($conf, $langs, $db, $filterobj, $objcon = '', $no
//TODO Add limit in nb of results
$sql .= $db->order($sortfield_new, $sortorder);
dol_syslog("company.lib::show_actions_done", LOG_DEBUG);
$resql = $db->query($sql);
if ($resql)
@ -529,6 +530,8 @@ function show_ticket_messaging($conf, $langs, $db, $filterobj, $objcon = '', $no
$out .= '<div class="filters-container" >';
$out .= '<form name="listactionsfilter" class="listactionsfilter" action="'.$_SERVER["PHP_SELF"].'" method="POST">';
$out .= '<input type="hidden" name="token" value="'.newToken().'">';
if ($objcon && get_class($objcon) == 'Contact' &&
(is_null($filterobj) || get_class($filterobj) == 'Societe'))
{

2
htdocs/main.inc.php
View File

@ -370,7 +370,7 @@ if ((!defined('NOCSRFCHECK') && empty($dolibarr_nocsrfcheck) && !empty($conf->gl
|| defined('CSRFCHECK_WITH_TOKEN')) // Check validity of token, only if option MAIN_SECURITY_CSRF_WITH_TOKEN enabled or if constant CSRFCHECK_WITH_TOKEN is set
{
// Check all cases that need a token (all POST actions, all actions and mass actions on pages with CSRFCHECK_WITH_TOKEN set, all sensitive GET actions)
if ($_SERVER['REQUEST_METHOD'] == 'POST' || ((GETPOSTISSET('action') || GETPOSTISSET('massaction')) && defined('CSRFCHECK_WITH_TOKEN')) || in_array(GETPOST('action', 'aZ09'), array('add', 'update', 'install', 'delete', 'deleteprof')))
if ($_SERVER['REQUEST_METHOD'] == 'POST' || ((GETPOSTISSET('action') || GETPOSTISSET('massaction')) && defined('CSRFCHECK_WITH_TOKEN')) || in_array(GETPOST('action', 'aZ09'), array('add', 'addtimespent', 'update', 'install', 'delete', 'deleteprof')))
{
if (!GETPOSTISSET('token')) {
dol_syslog("--- Access to ".$_SERVER["PHP_SELF"]." refused by CSRFCHECK_WITH_TOKEN protection. Token not provided.");