diff options
author | Igor Scheller <igor.scheller@igorshp.de> | 2018-11-20 16:02:03 +0100 |
---|---|---|
committer | msquare <msquare@notrademark.de> | 2018-11-21 19:24:36 +0100 |
commit | 944c29b96429ec95ac1371cb33cc43704a60c7b1 (patch) | |
tree | 7be99e68d8c15fc7e210a4b3ccc44861a8d1de64 /includes/controller/shift_entries_controller.php | |
parent | fd37c9d60ea818dc9a562fa88ff5f9a50132506f (diff) |
Require POST for sending forms
* Ensure that the form is submitted with a post request
* Replaced several links with forms
Closes #494 (Security Vulnerability)
Diffstat (limited to 'includes/controller/shift_entries_controller.php')
-rw-r--r-- | includes/controller/shift_entries_controller.php | 12 |
1 files changed, 6 insertions, 6 deletions
diff --git a/includes/controller/shift_entries_controller.php b/includes/controller/shift_entries_controller.php index 95fbccfc..16f0c0a1 100644 --- a/includes/controller/shift_entries_controller.php +++ b/includes/controller/shift_entries_controller.php @@ -96,7 +96,7 @@ function shift_entry_create_controller_admin($shift, $angeltype) $angeltype = $angeltypes[0]; } - if ($request->has('submit')) { + if ($request->hasPostData('submit')) { ShiftEntry_create([ 'SID' => $shift['SID'], 'TID' => $angeltype['id'], @@ -167,7 +167,7 @@ function shift_entry_create_controller_supporter($shift, $angeltype) redirect(shift_link($shift)); } - if ($request->has('submit')) { + if ($request->hasPostData('submit')) { ShiftEntry_create([ 'SID' => $shift['SID'], 'TID' => $angeltype['id'], @@ -246,7 +246,7 @@ function shift_entry_create_controller_user($shift, $angeltype) } $comment = ''; - if ($request->has('submit')) { + if ($request->hasPostData('submit')) { $comment = strip_request_item_nl('comment'); ShiftEntry_create([ 'SID' => $shift['SID'], @@ -346,7 +346,7 @@ function shift_entry_delete_controller() redirect(user_link($signout_user->id)); } - if ($request->has('continue')) { + if ($request->hasPostData('delete')) { ShiftEntry_delete($shiftEntry); success(__('Shift entry removed.')); redirect(shift_link($shift)); @@ -355,13 +355,13 @@ function shift_entry_delete_controller() if ($user->id == $signout_user->id) { return [ ShiftEntry_delete_title(), - ShiftEntry_delete_view($shiftEntry, $shift, $angeltype, $signout_user->id) + ShiftEntry_delete_view($shift, $angeltype, $signout_user->id) ]; } return [ ShiftEntry_delete_title(), - ShiftEntry_delete_view_admin($shiftEntry, $shift, $angeltype, $signout_user) + ShiftEntry_delete_view_admin($shift, $angeltype, $signout_user) ]; } |