#27 Add CSRF checking

pkp · Oct 3, 2023 · 407ba30 · 407ba30
1 parent b27afdd
commit 407ba30
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/controllers/grid/CustomLocaleGridHandler.php b/controllers/grid/CustomLocaleGridHandler.php
@@ -74,6 +74,8 @@ public function updateLocale(array $args, PKPRequest $request): JSONMessage
     {
         ['locale' => $locale, 'changes' => $changes] = $args;
 
+	if (!$request->checkCSRF()) return new JSONMessage(false);
+
         if (!count($changes)) {
             $this->setupTemplate($request);
             // Create and present the edit form

diff --git a/templates/localeFile.tpl b/templates/localeFile.tpl
@@ -7,6 +7,7 @@
  *}
 
 <form class="pkp_form" id="localeFilesForm" method="post" action="{url router=$smarty.const.ROUTE_COMPONENT component="plugins.generic.customLocale.controllers.grid.CustomLocaleGridHandler" op="updateLocale" locale=$locale key=$name anchor="localeContents"}">
+	{csrf}
 	<link rel="stylesheet" href="{$baseUrl}/plugins/generic/customLocale/css/customLocale.css" type="text/css" />
 	<div id="customLocales">
 		{* TABLE *}
@@ -185,4 +186,4 @@
 		customLocalesApp.data.localeKeysMaster = {$referenceLocaleContents|json_encode};
 		new pkp.Vue(customLocalesApp);
 	</script>
-</form>
+</form>