From dd2ac00aa215ea25c323b2943f2c7c61239477d1 Mon Sep 17 00:00:00 2001 From: johnnyq Date: Mon, 2 Mar 2026 20:26:43 -0500 Subject: [PATCH] certificates: Add missing CSRF checks rename unarchive to restore --- agent/certificates.php | 6 +++--- agent/modals/certificate/certificate_add.php | 2 ++ agent/modals/certificate/certificate_edit.php | 1 + .../modals/certificate/certificate_export.php | 1 + agent/post/certificate.php | 18 +++++++++++++++--- 5 files changed, 22 insertions(+), 6 deletions(-) diff --git a/agent/certificates.php b/agent/certificates.php index 408ad3c0..cfb3a9e5 100644 --- a/agent/certificates.php +++ b/agent/certificates.php @@ -271,16 +271,16 @@ $num_rows = mysqli_fetch_row(mysqli_query($mysqli, "SELECT FOUND_ROWS()"));
- + Restore
- + Delete
- + Archive diff --git a/agent/modals/certificate/certificate_add.php b/agent/modals/certificate/certificate_add.php index 0a7d52b6..3fe4f0dc 100644 --- a/agent/modals/certificate/certificate_add.php +++ b/agent/modals/certificate/certificate_add.php @@ -14,6 +14,8 @@ ob_start();
+ +
    diff --git a/agent/modals/certificate/certificate_edit.php b/agent/modals/certificate/certificate_edit.php index 569db8e6..ddb1be44 100644 --- a/agent/modals/certificate/certificate_edit.php +++ b/agent/modals/certificate/certificate_edit.php @@ -31,6 +31,7 @@ ob_start();
+
diff --git a/agent/modals/certificate/certificate_export.php b/agent/modals/certificate/certificate_export.php index e5182902..446b894b 100644 --- a/agent/modals/certificate/certificate_export.php +++ b/agent/modals/certificate/certificate_export.php @@ -15,6 +15,7 @@ ob_start();
+
diff --git a/agent/post/certificate.php b/agent/post/certificate.php index ce1a2d89..61ac1828 100644 --- a/agent/post/certificate.php +++ b/agent/post/certificate.php @@ -8,6 +8,8 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed"); if (isset($_POST['add_certificate'])) { + validateCSRFToken($_POST['csrf_token']); + enforceUserPermission('module_support', 2); require_once 'certificate_model.php'; @@ -42,6 +44,8 @@ if (isset($_POST['add_certificate'])) { if (isset($_POST['edit_certificate'])) { + validateCSRFToken($_POST['csrf_token']); + enforceUserPermission('module_support', 2); require_once 'certificate_model.php'; @@ -108,6 +112,8 @@ if (isset($_POST['edit_certificate'])) { if (isset($_GET['archive_certificate'])) { + validateCSRFToken($_GET['csrf_token']); + enforceUserPermission('module_support', 2); $certificate_id = intval($_GET['archive_certificate']); @@ -128,11 +134,13 @@ if (isset($_GET['archive_certificate'])) { } -if (isset($_GET['unarchive_certificate'])) { +if (isset($_GET['restore_certificate'])) { + + validateCSRFToken($_GET['csrf_token']); enforceUserPermission('module_support', 2); - $certificate_id = intval($_GET['unarchive_certificate']); + $certificate_id = intval($_GET['restore_certificate']); // Get Certificate Name and Client ID for logging and alert message $sql = mysqli_query($mysqli,"SELECT certificate_name, certificate_client_id FROM certificates WHERE certificate_id = $certificate_id"); @@ -142,7 +150,7 @@ if (isset($_GET['unarchive_certificate'])) { mysqli_query($mysqli,"UPDATE certificates SET certificate_archived_at = NULL WHERE certificate_id = $certificate_id"); - logAction("Certificate", "Unarchive", "$session_name restored certificate $certificate_name", $client_id, $certificate_id); + logAction("Certificate", "Restore", "$session_name restored certificate $certificate_name", $client_id, $certificate_id); flash_alert("Certificate $certificate_name restored"); @@ -152,6 +160,8 @@ if (isset($_GET['unarchive_certificate'])) { if (isset($_GET['delete_certificate'])) { + validateCSRFToken($_GET['csrf_token']); + enforceUserPermission('module_support', 3); $certificate_id = intval($_GET['delete_certificate']); @@ -212,6 +222,8 @@ if (isset($_POST['bulk_delete_certificates'])) { if (isset($_POST['export_certificates_csv'])) { + validateCSRFToken($_POST['csrf_token']); + enforceUserPermission('module_support'); if ($_POST['client_id']) {