From 944c29b96429ec95ac1371cb33cc43704a60c7b1 Mon Sep 17 00:00:00 2001
From: Igor Scheller <igor.scheller@igorshp.de>
Date: Tue, 20 Nov 2018 16:02:03 +0100
Subject: Require POST for sending forms

* Ensure that the form is submitted with a post request
* Replaced several links with forms

Closes #494 (Security Vulnerability)
---
 includes/controller/shifts_controller.php | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

(limited to 'includes/controller/shifts_controller.php')

diff --git a/includes/controller/shifts_controller.php b/includes/controller/shifts_controller.php
index ee6714d4..375ea6b6 100644
--- a/includes/controller/shifts_controller.php
+++ b/includes/controller/shifts_controller.php
@@ -81,7 +81,7 @@ function shift_edit_controller()
     $start = $shift['start'];
     $end = $shift['end'];
 
-    if ($request->has('submit')) {
+    if ($request->hasPostData('submit')) {
         // Name/Bezeichnung der Schicht, darf leer sein
         $title = strip_request_item('title');
 
@@ -222,7 +222,7 @@ function shift_delete_controller()
     }
 
     // Schicht löschen bestätigt
-    if ($request->has('delete')) {
+    if ($request->hasPostData('delete')) {
         Shift_delete($shift_id);
 
         engelsystem_log(
@@ -241,9 +241,10 @@ function shift_delete_controller()
             date('Y-m-d H:i', $shift['start']),
             date('H:i', $shift['end'])
         ), true),
-        '<a class="button" href="'
-        . page_link_to('user_shifts', ['delete_shift' => $shift_id, 'delete' => 1]) .
-        '">' . __('delete') . '</a>'
+        form([
+            form_hidden('delete_shift', $shift_id),
+            form_submit('delete', __('delete')),
+        ]),
     ]);
 }
 
-- 
cgit v1.2.3-70-g09d2