adam/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-08-10 10:42:59 +02:00
Code Issues Packages Projects Releases Wiki Activity

fixes #529, protect delete_orphans against CSRF

Browse Source
This commit is contained in:
plegall
2016-09-27 14:25:13 +02:00
parent 18791eb440
commit 6a8e158206
2 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/batch_manager.php
+2
View File
@@ -66,6 +66,8 @@ DELETE FROM '.CADDIE_TABLE.'
if ('delete_orphans' == $_GET['action'])
{
check_pwg_token();
$deleted_count = delete_elements(get_orphans(), true);
if ($deleted_count > 0)
admin/themes/default/template/batch_manager_global.tpl
+1 -1
View File
@@ -345,7 +345,7 @@ var sliders = {
{/foreach}
</select>
<a id="empty_caddie" href="admin.php?page=batch_manager&amp;action=empty_caddie" style="{if !isset($filter.prefilter) or $filter.prefilter ne 'caddie'}display:none{/if}">{'Empty caddie'|translate}</a>
<a id="delete_orphans" href="admin.php?page=batch_manager&amp;action=delete_orphans" style="{if !isset($filter.prefilter) or $filter.prefilter ne 'no_album'}display:none{/if}">{'Delete %d orphan photos'|translate:$NB_ORPHANS}</a>
<a id="delete_orphans" href="admin.php?page=batch_manager&amp;action=delete_orphans&amp;pwg_token={$PWG_TOKEN}" style="{if !isset($filter.prefilter) or $filter.prefilter ne 'no_album'}display:none{/if}">{'Delete %d orphan photos'|translate:$NB_ORPHANS}</a>
<span id="duplicates_options" style="{if !isset($filter.prefilter) or $filter.prefilter ne 'duplicates'}display:none{/if}">
{'based on'|translate}