AS1024/itflow
1
0
Fork 0
mirror of https://github.com/itflow-org/itflow synced 2026-07-27 02:37:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updated validateCSRFToken to automatically grab and compare get or post csrf token no longer need to pass an argument to the function which fixed the issue if no hash was present

Browse Source
This commit is contained in:
johnnyq
2026-07-24 13:40:37 -04:00
parent dd358da65d
commit af51c4316f
80 changed files with 519 additions and 517 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
client/post.php
View File

@@ -12,7 +12,7 @@ require_once 'functions.php';
if (isset($_POST['add_ticket'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$subject = escapeSql($_POST['subject']);
$details = mysqli_real_escape_string($mysqli, ($_POST['details']));
@@ -84,7 +84,7 @@ if (isset($_POST['add_ticket'])) {
if (isset($_POST['add_ticket_comment'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$ticket_id = intval($_POST['ticket_id']);
$comment = mysqli_real_escape_string($mysqli, $_POST['comment']);
@@ -191,7 +191,7 @@ if (isset($_POST['add_ticket_comment'])) {
if (isset($_GET['approve_ticket_task'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$task_id = intval($_GET['approve_ticket_task']);
$approval_id = intval($_GET['approval_id']);
@@ -230,7 +230,7 @@ if (isset($_GET['approve_ticket_task'])) {
if (isset($_POST['add_ticket_feedback'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$ticket_id = intval($_POST['ticket_id']);
$feedback = escapeSql($_POST['add_ticket_feedback']);
@@ -262,7 +262,7 @@ if (isset($_POST['add_ticket_feedback'])) {
if (isset($_GET['resolve_ticket'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$ticket_id = intval($_GET['resolve_ticket']);
@@ -297,7 +297,7 @@ if (isset($_GET['resolve_ticket'])) {
if (isset($_GET['reopen_ticket'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$ticket_id = intval($_GET['reopen_ticket']);
@@ -332,7 +332,7 @@ if (isset($_GET['reopen_ticket'])) {
if (isset($_GET['close_ticket'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$ticket_id = intval($_GET['close_ticket']);
@@ -378,7 +378,7 @@ if (isset($_GET['logout'])) {
if (isset($_POST['edit_profile'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$new_password = $_POST['new_password'];
@@ -396,7 +396,7 @@ if (isset($_POST['edit_profile'])) {
if (isset($_POST['add_contact'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
if ($session_contact_primary == 0 && !$session_contact_is_technical_contact) {
redirect("post.php?logout");
@@ -445,7 +445,7 @@ if (isset($_POST['add_contact'])) {
if (isset($_POST['edit_contact'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
if ($session_contact_primary == 0 && !$session_contact_is_technical_contact) {
redirect("post.php?logout");
@@ -497,7 +497,7 @@ if (isset($_POST['edit_contact'])) {
if (isset($_GET['add_payment_by_provider'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
$invoice_id = intval($_GET['invoice_id']);
$saved_payment_id = intval($_GET['add_payment_by_provider']);
@@ -687,7 +687,7 @@ if (isset($_GET['add_payment_by_provider'])) {
if (isset($_POST['create_stripe_customer'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
if ($session_contact_primary == 0 && !$session_contact_is_billing_contact) {
redirect("post.php?logout");
@@ -775,7 +775,7 @@ if (isset($_POST['create_stripe_customer'])) {
if (isset($_GET['create_stripe_checkout'])) {
//validateCSRFToken($_GET['csrf_token']);
//validateCSRFToken();
// This page is called by autopay_setup_stripe.js, returns a Checkout Session client_secret
@@ -847,7 +847,7 @@ if (isset($_GET['create_stripe_checkout'])) {
if (isset($_GET['stripe_save_card'])) {
// validateCSRFToken($_GET['csrf_token']); Broken with Stripe Save Card JQ 2026-5-4
// validateCSRFToken(); Broken with Stripe Save Card JQ 2026-5-4
if ($session_contact_primary == 0 && !$session_contact_is_billing_contact) {
redirect("post.php?logout");
@@ -978,7 +978,7 @@ if (isset($_GET['stripe_save_card'])) {
if (isset($_GET['delete_saved_payment'])) {
validateCSRFToken($_GET['csrf_token']);
validateCSRFToken();
if ($session_contact_primary == 0 && !$session_contact_is_billing_contact) {
redirect("post.php?logout");
@@ -1082,7 +1082,7 @@ if (isset($_GET['delete_saved_payment'])) {
if (isset($_POST['set_recurring_payment'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
$recurring_invoice_id = intval($_POST['recurring_invoice_id']);
$saved_payment_id = intval($_POST['saved_payment_id']);
@@ -1136,7 +1136,7 @@ if (isset($_POST['set_recurring_payment'])) {
if (isset($_POST['client_add_document'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
// Permission check - only primary or technical contacts can create documents
if ($session_contact_primary == 0 && !$session_contact_is_technical_contact) {
@@ -1182,7 +1182,7 @@ if (isset($_POST['client_add_document'])) {
if (isset($_POST['client_upload_document'])) {
validateCSRFToken($_POST['csrf_token']);
validateCSRFToken();
// Permission check - only primary or technical contacts can upload documents
if ($session_contact_primary == 0 && !$session_contact_is_technical_contact) {