lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add token for GET on page to setup journal.

Browse Source
This commit is contained in:
Laurent Destailleur 2020-09-30 12:54:05 +02:00
parent a3da2afe7a
commit 805f06fe31
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
htdocs/accountancy/admin/journals_list.php
View File

@ -22,6 +22,8 @@
* \brief Setup page to configure journals * \brief Setup page to configure journals
*/ */
if (! defined('CSRFCHECK_WITH_TOKEN')) define('CSRFCHECK_WITH_TOKEN','1'); // Force use of CSRF protection with tokens even for GET
require '../../main.inc.php'; require '../../main.inc.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formadmin.class.php'; require_once DOL_DOCUMENT_ROOT.'/core/class/html.formadmin.class.php';
require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php'; require_once DOL_DOCUMENT_ROOT.'/core/class/html.formcompany.class.php';
@ -636,19 +638,19 @@ if ($id)
// Active // Active
print '<td class="nowrap center">'; print '<td class="nowrap center">';
if ($canbedisabled) print '<a href="'.$url.'action='.$acts[$obj->active].'">'.$actl[$obj->active].'</a>'; if ($canbedisabled) print '<a href="'.$url.'action='.$acts[$obj->active].'&token='.newToken().'">'.$actl[$obj->active].'</a>';
else print $langs->trans("AlwaysActive"); else print $langs->trans("AlwaysActive");
print "</td>"; print "</td>";
// Modify link // Modify link
if ($canbemodified) print '<td class="center"><a class="reposition editfielda" href="'.$url.'action=edit">'.img_edit().'</a></td>'; if ($canbemodified) print '<td class="center"><a class="reposition editfielda" href="'.$url.'action=edit&token='.newToken().'">'.img_edit().'</a></td>';
else print '<td>&nbsp;</td>'; else print '<td>&nbsp;</td>';
// Delete link // Delete link
if ($iserasable) if ($iserasable)
{ {
print '<td class="center">'; print '<td class="center">';
if ($user->admin) print '<a href="'.$url.'action=delete">'.img_delete().'</a>'; if ($user->admin) print '<a href="'.$url.'action=delete&token='.newToken().'">'.img_delete().'</a>';
//else print '<a href="#">'.img_delete().'</a>'; // Some dictionary can be edited by other profile than admin //else print '<a href="#">'.img_delete().'</a>'; // Some dictionary can be edited by other profile than admin
print '</td>'; print '</td>';
} else print '<td>&nbsp;</td>'; } else print '<td>&nbsp;</td>';