Skip to content

Commit

Permalink
Browse files Browse the repository at this point in the history
Fix CSRF bugs
  • Loading branch information
erikdubbelboer committed Sep 8, 2021
1 parent f62fd14 commit b57e3b0
Show file tree
Hide file tree
Showing 4 changed files with 9 additions and 5 deletions.
4 changes: 4 additions & 0 deletions includes/header.inc.php
Expand Up @@ -35,5 +35,9 @@
<script src="js/<?php echo $js; ?>.js?v<?=$version?>"></script>
<?php } ?>

<script>
phpRedisAdmin_csrfToken = '<?php echo $csrfToken; ?>';
</script>

</head>
<body>
2 changes: 1 addition & 1 deletion index.php
Expand Up @@ -245,7 +245,7 @@ function getDbInfo($d, $info, $padding = '') {
</p>
<button id="selected_all_keys">Select all</button>
<button id="operations">
<a href="delete.php?s=<?php echo $server['id']?>&amp;d=<?php echo $server['db']?>&batch_del=1" class="batch_del">Delete selected<img src="images/delete.png" style="width: 1em;height: 1em;vertical-align: middle;" title="Delete selected" alt="[X]"></a>
<a href="delete.php?s=<?php echo $server['id']?>&amp;d=<?php echo $server['db']?>&batch_del=1&csrf=<?php echo $csrfToken; ?>" class="batch_del">Delete selected<img src="images/delete.png" style="width: 1em;height: 1em;vertical-align: middle;" title="Delete selected" alt="[X]"></a>
</button>
</div>
<div id="keys">
Expand Down
2 changes: 1 addition & 1 deletion js/frame.js
Expand Up @@ -18,7 +18,7 @@ $(function() {
$.ajax({
type: "POST",
url: this.href,
data: 'post=1',
data: 'post=1&csrf=' + phpRedisAdmin_csrfToken,
success: function(url) {
top.location.href = top.location.pathname+url;
}
Expand Down
6 changes: 3 additions & 3 deletions js/index.js
Expand Up @@ -28,7 +28,7 @@ $(function() {
$.ajax({
type: "POST",
url: this.href,
data: 'post=1&selected_keys=' + selected_keys,
data: 'post=1&selected_keys=' + selected_keys + '&csrf=' + phpRedisAdmin_csrfToken,
success: function(url) {
top.location.href = top.location.pathname+url;
}
Expand All @@ -41,7 +41,7 @@ $(function() {
$.ajax({
type: "POST",
url: this.href,
data: 'post=1',
data: 'post=1&csrf=' + phpRedisAdmin_csrfToken,
success: function(url) {
top.location.href = top.location.pathname+url;
}
Expand Down Expand Up @@ -74,7 +74,7 @@ $(function() {
$.ajax({
type: "POST",
url: href,
data: 'post=1',
data: 'post=1&csrf=' + phpRedisAdmin_csrfToken,
success: function() {
window.location.reload();
}
Expand Down

0 comments on commit b57e3b0

Please sign in to comment.