From 944c29b96429ec95ac1371cb33cc43704a60c7b1 Mon Sep 17 00:00:00 2001
From: Igor Scheller <igor.scheller@igorshp.de>
Date: Tue, 20 Nov 2018 16:02:03 +0100
Subject: Require POST for sending forms

* Ensure that the form is submitted with a post request
* Replaced several links with forms

Closes #494 (Security Vulnerability)
---
 includes/sys_form.php | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

(limited to 'includes/sys_form.php')

diff --git a/includes/sys_form.php b/includes/sys_form.php
index 07a61dbb..f9779ec7 100644
--- a/includes/sys_form.php
+++ b/includes/sys_form.php
@@ -216,13 +216,23 @@ function form_info($label, $text = '')
  *
  * @param string $name
  * @param string $label
+ * @param string $class
+ * @param bool   $wrapForm
  * @return string
  */
-function form_submit($name, $label)
+function form_submit($name, $label, $class = '', $wrapForm = true)
 {
+    $button = '<button class="btn btn-primary' . ($class ? ' ' . $class : '') . '" type="submit" name="' . $name . '">'
+        . $label
+        . '</button>';
+
+    if (!$wrapForm) {
+        return $button;
+    }
+
     return form_element(
-        '<button class="btn btn-primary" type="submit" name="' . $name . '">' . $label . '</button>',
-        ''
+        null,
+        $button
     );
 }
 
@@ -391,7 +401,7 @@ function form_select($name, $label, $values, $selected, $selectText = '')
  */
 function form_element($label, $input, $for = '')
 {
-    if ($label == '') {
+    if (empty($label)) {
         return '<div class="form-group">' . $input . '</div>';
     }
 
-- 
cgit v1.3.1