adam/Piwigo
1
0
Fork 0
mirror of https://github.com/Piwigo/Piwigo.git synced 2026-08-07 01:03:31 +02:00
Code Issues Packages Projects Releases Wiki Activity

fixes GHSA-p362-cfpj-q55f protect against CSRF on batch manager unit mode

Browse Source
This commit is contained in:
plegall
2024-02-12 16:51:53 +01:00
parent 562170528c
commit e95036b92a
3 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin/batch_manager_unit.php
+2
View File
@@ -32,6 +32,7 @@ trigger_notify('loc_begin_element_set_unit');
if (isset($_POST['submit'])) if (isset($_POST['submit']))
{ {
check_pwg_token();
check_input_parameter('element_ids', $_POST, false, '/^\d+(,\d+)*$/'); check_input_parameter('element_ids', $_POST, false, '/^\d+(,\d+)*$/');
$collection = explode(',', $_POST['element_ids']); $collection = explode(',', $_POST['element_ids']);
@@ -110,6 +111,7 @@ $template->assign(
'F_ACTION' => $base_url.get_query_string_diff(array()), 'F_ACTION' => $base_url.get_query_string_diff(array()),
'level_options' => get_privacy_level_options(), 'level_options' => get_privacy_level_options(),
'ADMIN_PAGE_TITLE' => l10n('Batch Manager'), 'ADMIN_PAGE_TITLE' => l10n('Batch Manager'),
'PWG_TOKEN' => get_pwg_token(),
) )
); );
admin/include/functions.php
+1 -1
View File
@@ -2862,7 +2862,7 @@ function get_tag_ids($raw_tags, $allow_create=true)
elseif ($allow_create) elseif ($allow_create)
{ {
// we have to create a new tag // we have to create a new tag
$tag_ids[] = tag_id_from_tag_name($raw_tag); $tag_ids[] = tag_id_from_tag_name(strip_tags($raw_tag));
} }
} }
admin/themes/default/template/batch_manager_unit.tpl
+1
View File
@@ -114,6 +114,7 @@ jQuery("a.preview-box").colorbox( {
{if !empty($navbar)}{include file='navigation_bar.tpl'|@get_extent:'navbar'}{/if} {if !empty($navbar)}{include file='navigation_bar.tpl'|@get_extent:'navbar'}{/if}
<p> <p>
<input type="hidden" name="pwg_token" value="{$PWG_TOKEN}">
<button class="buttonLike" type="submit" value="{'Submit'|@translate}" name="submit"><i class="icon-floppy"></i>{'Submit'|@translate}</button> <button class="buttonLike" type="submit" value="{'Submit'|@translate}" name="submit"><i class="icon-floppy"></i>{'Submit'|@translate}</button>
<button class="resetButton" type="reset" value="{'Reset'|@translate}" name="reset">{'Reset'|@translate}</button> <button class="resetButton" type="reset" value="{'Reset'|@translate}" name="reset">{'Reset'|@translate}</button>