Require CSRF token to edit more admin settings - thanks again to @stehled

2026-03-01 03:14:52 +00:00 · 2023-11-25 18:15:25 +00:00
parent 51ac53dc50
commit 8068cb6081
19 changed files with 54 additions and 10 deletions
--- a/settings_company.php
+++ b/settings_company.php
@@ -29,6 +29,7 @@ $company_initials = nullable_htmlentities(initials($company_name));
        </div>
        <div class="card-body">
            <form action="post.php" method="post" enctype="multipart/form-data" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

                <div class="form-group">
                    <label>Name <strong class="text-danger">*</strong></label>