From 944c29b96429ec95ac1371cb33cc43704a60c7b1 Mon Sep 17 00:00:00 2001
From: Igor Scheller <igor.scheller@igorshp.de>
Date: Tue, 20 Nov 2018 16:02:03 +0100
Subject: Require POST for sending forms

* Ensure that the form is submitted with a post request
* Replaced several links with forms

Closes #494 (Security Vulnerability)
---
 includes/controller/shifttypes_controller.php | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'includes/controller/shifttypes_controller.php')

diff --git a/includes/controller/shifttypes_controller.php b/includes/controller/shifttypes_controller.php
index 8b30ea60..3c825d0c 100644
--- a/includes/controller/shifttypes_controller.php
+++ b/includes/controller/shifttypes_controller.php
@@ -26,7 +26,7 @@ function shifttype_delete_controller()
         redirect(page_link_to('shifttypes'));
     }
 
-    if ($request->has('confirmed')) {
+    if ($request->hasPostData('delete')) {
         ShiftType_delete($shifttype['id']);
 
         engelsystem_log('Deleted shifttype ' . $shifttype['name']);
@@ -67,7 +67,7 @@ function shifttype_edit_controller()
         $description = $shifttype['description'];
     }
 
-    if ($request->has('submit')) {
+    if ($request->hasPostData('submit')) {
         $valid = true;
 
         if ($request->has('name') && $request->input('name') != '') {
-- 
cgit v1.2.3-70-g09d2