From 944c29b96429ec95ac1371cb33cc43704a60c7b1 Mon Sep 17 00:00:00 2001 From: Igor Scheller Date: Tue, 20 Nov 2018 16:02:03 +0100 Subject: Require POST for sending forms * Ensure that the form is submitted with a post request * Replaced several links with forms Closes #494 (Security Vulnerability) --- includes/pages/admin_groups.php | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'includes/pages/admin_groups.php') diff --git a/includes/pages/admin_groups.php b/includes/pages/admin_groups.php index 727d7be5..ca6aba72 100644 --- a/includes/pages/admin_groups.php +++ b/includes/pages/admin_groups.php @@ -110,7 +110,11 @@ function admin_groups() break; case 'save': - if ($request->has('id') && preg_match('/^-\d{1,11}$/', $request->input('id'))) { + if ( + $request->has('id') + && preg_match('/^-\d{1,11}$/', $request->input('id')) + && $request->hasPostData('submit') + ) { $group_id = $request->input('id'); } else { return error('Incomplete call, missing Groups ID.', true); -- cgit v1.2.3-70-g09d2