Skip to content

Commit

Permalink
Require CSRF token to edit more admin settings - thanks again to @ste…
Browse files Browse the repository at this point in the history 
…hled
  • Loading branch information
@wrongecho
wrongecho committed Nov 25, 2023
1 parent 51ac53d commit 8068cb6
Show file tree
Hide file tree
Showing 19 changed files with 54 additions and 10 deletions.
17 changes: 17 additions & 0 deletions post/setting.php
View file
Expand Up @@ -6,6 +6,7 @@

if (isset($_POST['edit_company'])) {

validateCSRFToken($_POST['csrf_token']);
validateAdminRole();

require_once 'post/setting_company_model.php';
Expand Down Expand Up @@ -53,6 +54,7 @@

if (isset($_POST['edit_localization'])) {

validateCSRFToken($_POST['csrf_token']);
validateAdminRole();

$locale = sanitizeInput($_POST['locale']);
Expand All @@ -74,6 +76,7 @@

if (isset($_POST['edit_mail_smtp_settings'])) {

validateCSRFToken($_POST['csrf_token']);
validateAdminRole();

$config_smtp_host = sanitizeInput($_POST['config_smtp_host']);
Expand All @@ -95,6 +98,7 @@

if (isset($_POST['edit_mail_imap_settings'])) {

validateCSRFToken($_POST['csrf_token']);
validateAdminRole();

$config_imap_host = sanitizeInput($_POST['config_imap_host']);
Expand All @@ -117,6 +121,7 @@

if (isset($_POST['edit_mail_from_settings'])) {

validateCSRFToken($_POST['csrf_token']);
validateAdminRole();

$config_mail_from_email = sanitizeInput($_POST['config_mail_from_email']);
Expand Down Expand Up @@ -144,6 +149,7 @@

if (isset($_POST['test_email_smtp'])) {

validateCSRFToken($_POST['csrf_token']);
validateAdminRole();
$email_from = sanitizeInput($_POST['email_from']);
$email_to = sanitizeInput($_POST['email_to']);
Expand All @@ -167,6 +173,7 @@

if (isset($_POST['test_email_imap'])) {

validateCSRFToken($_POST['csrf_token']);
validateAdminRole();

// Prepare connection string with encryption (TLS/SSL/<blank>)
Expand All @@ -188,6 +195,7 @@

if (isset($_POST['edit_invoice_settings'])) {

validateCSRFToken($_POST['csrf_token']);
validateAdminRole();

$config_invoice_prefix = sanitizeInput($_POST['config_invoice_prefix']);
Expand All @@ -212,6 +220,7 @@

if (isset($_POST['edit_quote_settings'])) {

validateCSRFToken($_POST['csrf_token']);
validateAdminRole();

$config_quote_prefix = sanitizeInput($_POST['config_quote_prefix']);
Expand Down Expand Up @@ -254,6 +263,7 @@

if (isset($_POST['edit_default_settings'])) {

validateCSRFToken($_POST['csrf_token']);
validateAdminRole();

$start_page = sanitizeInput($_POST['start_page']);
Expand All @@ -279,6 +289,7 @@

if (isset($_POST['edit_theme_settings'])) {

validateCSRFToken($_POST['csrf_token']);
validateAdminRole();

$theme = preg_replace("/[^0-9a-zA-Z-]/", "", sanitizeInput($_POST['theme']));
Expand All @@ -295,6 +306,7 @@

if (isset($_POST['edit_alert_settings'])) {

validateCSRFToken($_POST['csrf_token']);
validateAdminRole();

$config_enable_cron = intval($_POST['config_enable_cron']);
Expand Down Expand Up @@ -351,6 +363,7 @@

if (isset($_POST['edit_integrations_settings'])) {

validateCSRFToken($_POST['csrf_token']);
validateAdminRole();

$azure_client_id = sanitizeInput($_POST['azure_client_id']);
Expand Down Expand Up @@ -388,6 +401,8 @@
}

if (isset($_POST['edit_security_settings'])) {

validateCSRFToken($_POST['csrf_token']);
validateAdminRole();

$config_login_message = sanitizeInput($_POST['config_login_message']);
Expand All @@ -406,6 +421,7 @@

if (isset($_POST['edit_telemetry_settings'])) {

validateCSRFToken($_POST['csrf_token']);
validateAdminRole();

$config_telemetry = intval($_POST['config_telemetry']);
Expand Down Expand Up @@ -697,6 +713,7 @@

if (isset($_GET['download_database'])) {

validateCSRFToken($_GET['csrf_token']);
validateAdminRole();

// Get All Table Names From the Database
Expand Down
3 changes: 3 additions & 0 deletions post/tax.php
View file
Expand Up @@ -6,6 +6,7 @@

if (isset($_POST['add_tax'])) {

validateCSRFToken($_POST['csrf_token']);
$name = sanitizeInput($_POST['name']);
$percent = floatval($_POST['percent']);

Expand All @@ -22,6 +23,7 @@

if (isset($_POST['edit_tax'])) {

validateCSRFToken($_POST['csrf_token']);
$tax_id = intval($_POST['tax_id']);
$name = sanitizeInput($_POST['name']);
$percent = floatval($_POST['percent']);
Expand All @@ -38,6 +40,7 @@
}

if (isset($_GET['archive_tax'])) {
validateCSRFToken($_GET['csrf_token']);
$tax_id = intval($_GET['archive_tax']);

mysqli_query($mysqli,"UPDATE taxes SET tax_archived_at = NOW() WHERE tax_id = $tax_id");
Expand Down
1 change: 1 addition & 0 deletions settings_alerts.php
View file
Expand Up @@ -8,6 +8,7 @@
</div>
<div class="card-body">
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

<div class="form-group">
<div class="custom-control custom-switch">
Expand Down
2 changes: 1 addition & 1 deletion settings_backup.php
View file
Expand Up @@ -7,7 +7,7 @@
<h3 class="card-title"><i class="fas fa-fw fa-database mr-2"></i>Download Database</h3>
</div>
<div class="card-body" style="text-align: center;">
<a class="btn btn-primary btn-lg p-3" href="post.php?download_database"><i class="fas fa-fw fa-4x fa-download"></i><br><br>Download</a>
<a class="btn btn-primary btn-lg p-3" href="post.php?download_database&csrf_token=<?php echo $_SESSION['csrf_token'] ?>"><i class="fas fa-fw fa-4x fa-download"></i><br><br>Download</a>
</div>
</div>

Expand Down
1 change: 1 addition & 0 deletions settings_company.php
View file
Expand Up @@ -29,6 +29,7 @@
</div>
<div class="card-body">
<form action="post.php" method="post" enctype="multipart/form-data" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

<div class="form-group">
<label>Name <strong class="text-danger">*</strong></label>
Expand Down
3 changes: 2 additions & 1 deletion settings_defaults.php
View file
Expand Up @@ -9,6 +9,7 @@
</div>
<div class="card-body">
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

<div class="form-group">
<label>Start Page</label>
Expand All @@ -21,7 +22,7 @@
<option selected> <?php echo nullable_htmlentities($config_start_page); ?></option>
<?php } ?>
<?php foreach ($start_page_select_array as $start_page_value => $start_page_name) { ?>
<option <?php if ($start_page_value == $config_start_page) { echo "selected"; } ?>
<option <?php if ($start_page_value == $config_start_page) { echo "selected"; } ?>
value="<?php echo nullable_htmlentities($start_page_value); ?>">
<?php echo nullable_htmlentities($start_page_name); ?>
</option>
Expand Down
1 change: 1 addition & 0 deletions settings_integrations.php
View file
Expand Up @@ -8,6 +8,7 @@
</div>
<div class="card-body">
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

<h4>Client Portal SSO via Microsoft Azure AD</h4>
<div class="form-group">
Expand Down
1 change: 1 addition & 0 deletions settings_invoice.php
View file
Expand Up @@ -8,6 +8,7 @@
</div>
<div class="card-body">
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

<h4>Invoice</h4>

Expand Down
1 change: 1 addition & 0 deletions settings_localization.php
View file
Expand Up @@ -19,6 +19,7 @@
</div>
<div class="card-body">
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

<div class="form-group">
<label>Language <strong class="text-danger">*</strong></label>
Expand Down
8 changes: 8 additions & 0 deletions settings_mail.php
View file
Expand Up @@ -8,6 +8,7 @@
</div>
<div class="card-body">
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

<div class="form-group">
<label>SMTP Host</label>
Expand Down Expand Up @@ -80,6 +81,7 @@
</div>
<div class="card-body">
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

<div class="form-group">
<label>IMAP Host</label>
Expand Down Expand Up @@ -154,6 +156,8 @@
</div>
<div class="card-body">
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

<p>Each of the "From Email" Addresses need to be able to send email on behalf of the SMTP user configured above
<h5>System Default</h5>
<p class="text-secondary">(used for system tasks such as sending share links)</p>
Expand Down Expand Up @@ -262,6 +266,8 @@
</div>
<div class="card-body">
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

<div class="input-group">
<select class="form-control select2" name="email_from" required>
<option value="">- Select an Email Address to send from -</option>
Expand Down Expand Up @@ -308,6 +314,8 @@
</div>
<div class="card-body">
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

<div class="input-group-append">
<button type="submit" name="test_email_imap" class="btn btn-success"><i class="fas fa-fw fa-inbox mr-2"></i>Test</button>
</div>
Expand Down
1 change: 1 addition & 0 deletions settings_modules.php
View file
Expand Up @@ -8,6 +8,7 @@
</div>
<div class="card-body">
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

<div class="form-group">
<div class="custom-control custom-switch">
Expand Down
1 change: 1 addition & 0 deletions settings_quote.php
View file
Expand Up @@ -8,6 +8,7 @@
</div>
<div class="card-body">
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

<div class="form-group">
<label>Quote Prefix</label>
Expand Down
1 change: 1 addition & 0 deletions settings_security.php
View file
Expand Up @@ -9,6 +9,7 @@
</div>
<div class="card-body">
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

<div class="form-group">
<label>Login Message</label>
Expand Down
4 changes: 3 additions & 1 deletion settings_tax_add_modal.php
View file
Expand Up @@ -8,6 +8,8 @@
</button>
</div>
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

<div class="modal-body bg-white">
<div class="form-group">
<label>Name <strong class="text-danger">*</strong></label>
Expand All @@ -25,4 +27,4 @@
</form>
</div>
</div>
</div>
</div>
12 changes: 7 additions & 5 deletions settings_tax_edit_modal.php
View file
Expand Up @@ -8,20 +8,22 @@
</button>
</div>
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
<input type="hidden" name="tax_id" value="<?php echo $tax_id; ?>">

<div class="modal-body bg-white">

<div class="form-group">
<label>Name <strong class="text-danger">*</strong></label>
<input type="text" class="form-control" name="name" value="<?php echo $tax_name; ?>" required>
</div>

<div class="form-group">
<label>Percent <strong class="text-danger">*</strong></label>
<input type="number" min="0" step="any" class="form-control col-md-4" name="percent" value="<?php echo $tax_percent; ?>">

</div>

</div>
<div class="modal-footer bg-white">
<button type="submit" name="edit_tax" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Save</button>
Expand All @@ -30,4 +32,4 @@
</form>
</div>
</div>
</div>
</div>
4 changes: 2 additions & 2 deletions settings_taxes.php
View file
Expand Up @@ -11,7 +11,7 @@
$url_query_strings_sort = http_build_query($get_copy);

$sql = mysqli_query(
$mysqli,
$mysqli,
"SELECT * FROM taxes
WHERE tax_archived_at IS NULL
ORDER BY $sort $order"
Expand Down Expand Up @@ -60,7 +60,7 @@
<i class="fas fa-fw fa-edit mr-2"></i>Edit
</a>
<div class="dropdown-divider"></div>
<a class="dropdown-item text-danger confirm-link" href="post.php?archive_tax=<?php echo $tax_id; ?>">
<a class="dropdown-item text-danger confirm-link" href="post.php?archive_tax=<?php echo $tax_id; ?>&csrf_token=<?php echo $_SESSION['csrf_token'] ?>">
<i class="fas fa-fw fa-archive mr-2"></i>Archive
</a>
</div>
Expand Down
1 change: 1 addition & 0 deletions settings_telemetry.php
View file
Expand Up @@ -11,6 +11,7 @@
<p class="text-center">Installation ID: <strong><?php echo $installation_id; ?></strong></p>

<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

<div class="form-group">
<label>Telemetry</label>
Expand Down
1 change: 1 addition & 0 deletions settings_theme.php
View file
Expand Up @@ -8,6 +8,7 @@
</div>
<div class="card-body">
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

<label>Select a Theme</label>
<div class="form-row">
Expand Down
1 change: 1 addition & 0 deletions settings_ticket.php
View file
Expand Up @@ -8,6 +8,7 @@
</div>
<div class="card-body">
<form action="post.php" method="post" autocomplete="off">
<input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

<div class="form-group">
<label>Ticket Prefix</label>
Expand Down

0 comments on commit 8068cb6

Please sign in to comment.