From cce47f94375bb0102ab4f210672231dbb854dd0d Mon Sep 17 00:00:00 2001
From: Thorsten Rinne <thorsten@phpmyfaq.de>
Date: Wed, 27 Sep 2017 19:31:16 +0200
Subject: [PATCH] Fixed possible direct calls

---
 phpmyfaq/admin/stat.ratings.php | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/phpmyfaq/admin/stat.ratings.php b/phpmyfaq/admin/stat.ratings.php
index 7ea49fe6f2..2874b23d6e 100644
--- a/phpmyfaq/admin/stat.ratings.php
+++ b/phpmyfaq/admin/stat.ratings.php
@@ -41,7 +41,8 @@
                     <i aria-hidden="true" class="fa fa-tasks"></i> <?php echo $PMF_LANG['ad_rs'] ?>
 
                     <div class="pull-right">
-                        <a class="btn btn-danger" href="?action=clear-statistics">
+                        <a class="btn btn-danger" 
+                           href="?action=clear-statistics&csrf=<?php echo $user->getCsrfTokenFromSession() ?>">
                             <i aria-hidden="true" class="fa fa-trash"></i> <?php echo $PMF_LANG['ad_delete_all_votings'] ?>
                         </a>
                     </div>
@@ -50,7 +51,15 @@
         </header>
 
 <?php
-    if ('clear-statistics' === $action) {
+    $csrfToken = PMF_Filter::filterInput(INPUT_GET, 'csrf', FILTER_SANITIZE_STRING);
+
+    if (!isset($_SESSION['phpmyfaq_csrf_token']) || $_SESSION['phpmyfaq_csrf_token'] !== $csrfToken) {
+        $clearStatistics = false;
+    } else {
+        $clearStatistics = true;
+    }
+
+    if ('clear-statistics' === $action && $clearStatistics) {
         if ($ratings->deleteAll()) {
             echo '<p class="alert alert-success">Statistics successfully deleted.</p>';
         } else {