From 36ac0064382b29741944dcd8c8a4976426371f6e Mon Sep 17 00:00:00 2001 From: johnnyq Date: Sun, 1 Mar 2026 22:50:04 -0500 Subject: [PATCH] Products: Add missing CSRF checks change wording from unarchive to restore --- agent/modals/product/product_add.php | 1 + agent/modals/product/product_edit.php | 1 + agent/modals/product/product_export.php | 1 + agent/modals/product/product_stock_add.php | 1 + agent/post/product.php | 36 ++++++++++++++-------- agent/products.php | 8 ++--- 6 files changed, 32 insertions(+), 16 deletions(-) diff --git a/agent/modals/product/product_add.php b/agent/modals/product/product_add.php index 38ca9dc3..c8b24c81 100644 --- a/agent/modals/product/product_add.php +++ b/agent/modals/product/product_add.php @@ -22,6 +22,7 @@ ob_start();
+
diff --git a/agent/modals/product/product_edit.php b/agent/modals/product/product_edit.php index 79df1926..33c9b174 100644 --- a/agent/modals/product/product_edit.php +++ b/agent/modals/product/product_edit.php @@ -28,6 +28,7 @@ ob_start();
+
diff --git a/agent/modals/product/product_export.php b/agent/modals/product/product_export.php index 798b0fa0..ad8dfe58 100644 --- a/agent/modals/product/product_export.php +++ b/agent/modals/product/product_export.php @@ -13,6 +13,7 @@ ob_start();
+
diff --git a/agent/modals/product/product_stock_add.php b/agent/modals/product/product_stock_add.php index ba664370..b7b91cb1 100644 --- a/agent/modals/product/product_stock_add.php +++ b/agent/modals/product/product_stock_add.php @@ -18,6 +18,7 @@ ob_start(); +
diff --git a/agent/post/product.php b/agent/post/product.php index 765735fa..41d802e2 100644 --- a/agent/post/product.php +++ b/agent/post/product.php @@ -8,6 +8,8 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); if (isset($_POST['add_product'])) { + validateCSRFToken($_POST['csrf_token']); + enforceUserPermission('module_sales', 2); require_once 'product_model.php'; @@ -27,6 +29,8 @@ if (isset($_POST['add_product'])) { if (isset($_POST['edit_product'])) { + validateCSRFToken($_POST['csrf_token']); + enforceUserPermission('module_sales', 2); require_once 'product_model.php'; @@ -45,6 +49,8 @@ if (isset($_POST['edit_product'])) { if (isset($_GET['archive_product'])) { + validateCSRFToken($_GET['csrf_token']); + enforceUserPermission('module_sales', 2); $product_id = intval($_GET['archive_product']); @@ -61,17 +67,19 @@ if (isset($_GET['archive_product'])) { } -if (isset($_GET['unarchive_product'])) { +if (isset($_GET['restore_product'])) { + + validateCSRFToken($_GET['csrf_token']); enforceUserPermission('module_sales', 2); - $product_id = intval($_GET['unarchive_product']); + $product_id = intval($_GET['restore_product']); $product_name = sanitizeInput(getFieldById('products', $product_id, 'product_name')); mysqli_query($mysqli,"UPDATE products SET product_archived_at = NULL WHERE product_id = $product_id"); - logAction("Product", "Unarchive", "$session_name unarchived product $product_name", 0, $product_id); + logAction("Product", "Restore", "$session_name restored product $product_name", 0, $product_id); flash_alert("Product $product_name restored"); @@ -80,7 +88,9 @@ if (isset($_GET['unarchive_product'])) { } if (isset($_GET['delete_product'])) { - + + validateCSRFToken($_GET['csrf_token']); + enforceUserPermission('module_sales', 3); $product_id = intval($_GET['delete_product']); @@ -100,6 +110,8 @@ if (isset($_GET['delete_product'])) { if (isset($_POST['bulk_edit_product_category'])) { + validateCSRFToken($_POST['csrf_token']); + enforceUserPermission('module_sales', 2); $category_id = intval($_POST['bulk_category_id']); @@ -135,7 +147,7 @@ if (isset($_POST['bulk_edit_product_category'])) { } if (isset($_POST['bulk_archive_products'])) { - + validateCSRFToken($_POST['csrf_token']); enforceUserPermission('module_sales', 2); @@ -166,10 +178,10 @@ if (isset($_POST['bulk_archive_products'])) { } -if (isset($_POST['bulk_unarchive_products'])) { +if (isset($_POST['bulk_restore_products'])) { validateCSRFToken($_POST['csrf_token']); - + enforceUserPermission('module_sales', 2); if (isset($_POST['product_ids'])) { @@ -185,13 +197,13 @@ if (isset($_POST['bulk_unarchive_products'])) { mysqli_query($mysqli,"UPDATE products SET product_archived_at = NULL WHERE product_id = $product_id"); - logAction("Product", "Unarchive", "$session_name unarchived product $product_name", 0, $product_id); + logAction("Product", "Restore", "$session_name restored product $product_name", 0, $product_id); } - logAction("Product", "Bulk Unarchive", "$session_name unarchived $count product(s)"); + logAction("Product", "Bulk Restore", "$session_name restored $count product(s)"); - flash_alert("Unarchived $count product(s)"); + flash_alert("Restored $count product(s)"); } @@ -202,9 +214,9 @@ if (isset($_POST['bulk_unarchive_products'])) { if (isset($_POST['bulk_delete_products'])) { validateCSRFToken($_POST['csrf_token']); - + enforceUserPermission('module_sales', 3); - + if (isset($_POST['product_ids'])) { diff --git a/agent/products.php b/agent/products.php index eb131867..b20e9a8c 100644 --- a/agent/products.php +++ b/agent/products.php @@ -287,18 +287,18 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- - Unarchive + + Restore
- + Delete
- + Archive