From e1daa140874624e2bb3c62e371be649de734d8c4 Mon Sep 17 00:00:00 2001
From: johnnyq <johnny@pittpc.com>
Date: Sun, 1 Mar 2026 21:52:28 -0500
Subject: [PATCH] Calendar: Add missing CSRF checks

---
 agent/modals/calendar/calendar_add.php        |  3 +++
 agent/modals/calendar/calendar_edit.php       |  1 +
 agent/modals/calendar/calendar_event_add.php  |  1 +
 agent/modals/calendar/calendar_event_edit.php |  3 ++-
 agent/post/event.php                          | 10 ++++++++++
 5 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/agent/modals/calendar/calendar_add.php b/agent/modals/calendar/calendar_add.php
index 507cddb5..dfdedf2e 100644
--- a/agent/modals/calendar/calendar_add.php
+++ b/agent/modals/calendar/calendar_add.php
@@ -12,6 +12,9 @@ ob_start();
     </button>
 </div>
 <form action="post.php" method="post" autocomplete="off">
+
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
+
     <div class="modal-body">
 
         <div class="form-group">
diff --git a/agent/modals/calendar/calendar_edit.php b/agent/modals/calendar/calendar_edit.php
index 37f4e7bf..f92b92c6 100644
--- a/agent/modals/calendar/calendar_edit.php
+++ b/agent/modals/calendar/calendar_edit.php
@@ -21,6 +21,7 @@ ob_start();
     </button>
 </div>
 <form action="post.php" method="post" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <input type="hidden" name="calendar_id" value="<?php echo $calendar_id; ?>">
     <div class="modal-body">
 
diff --git a/agent/modals/calendar/calendar_event_add.php b/agent/modals/calendar/calendar_event_add.php
index 52b17fab..4ff3549e 100644
--- a/agent/modals/calendar/calendar_event_add.php
+++ b/agent/modals/calendar/calendar_event_add.php
@@ -8,6 +8,7 @@
                 </button>
             </div>
             <form action="post.php" method="post" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
                 <div class="modal-body">
 
                     <ul class="nav nav-pills nav-justified mb-3">
diff --git a/agent/modals/calendar/calendar_event_edit.php b/agent/modals/calendar/calendar_event_edit.php
index a46e3f96..234bb0a9 100644
--- a/agent/modals/calendar/calendar_event_edit.php
+++ b/agent/modals/calendar/calendar_event_edit.php
@@ -29,6 +29,7 @@ ob_start();
 </div>
 
 <form action="post.php" method="post" autocomplete="off">
+    <input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
     <input type="hidden" name="event_id" value="<?php echo $event_id; ?>">
 
     <div class="modal-body">
@@ -184,7 +185,7 @@ ob_start();
 
     </div>
     <div class="modal-footer">
-        <a class="btn btn-default text-danger mr-auto" href="post.php?delete_event=<?php echo $event_id; ?>"><i class="fa fa-calendar-times mr-2"></i>Delete</a>
+        <a class="btn btn-default text-danger mr-auto" href="post.php?delete_event=<?= $event_id ?>&csrf_token=<?= $_SESSION['csrf_token'] ?>"><i class="fa fa-calendar-times mr-2"></i>Delete</a>
         <button type="submit" name="edit_event" class="btn btn-primary text-bold"><i class="fa fa-check mr-2"></i>Save</button>
         <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fa fa-times mr-2"></i>Cancel</button>
     </div>
diff --git a/agent/post/event.php b/agent/post/event.php
index 93cd4eae..377bee1d 100644
--- a/agent/post/event.php
+++ b/agent/post/event.php
@@ -8,6 +8,8 @@ defined('FROM_POST_HANDLER') || die("Direct file access is not allowed");
 
 if (isset($_POST['add_calendar'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
+
     $name = sanitizeInput($_POST['name']);
     $color = sanitizeInput($_POST['color']);
 
@@ -25,6 +27,8 @@ if (isset($_POST['add_calendar'])) {
 
 if (isset($_POST['edit_calendar'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
+
     $calendar_id = intval($_POST['calendar_id']);
     $name = sanitizeInput($_POST['name']);
     $color = sanitizeInput($_POST['color']);
@@ -41,6 +45,8 @@ if (isset($_POST['edit_calendar'])) {
 
 if (isset($_POST['add_event'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
+
     require_once 'event_model.php';
 
     mysqli_query($mysqli,"INSERT INTO calendar_events SET event_title = '$title', event_location = '$location', event_description = '$description', event_start = '$start', event_end = '$end', event_repeat = '$repeat', event_calendar_id = $calendar_id, event_client_id = $client");
@@ -111,6 +117,8 @@ if (isset($_POST['add_event'])) {
 
 if (isset($_POST['edit_event'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
+
     require_once 'event_model.php';
 
     $event_id = intval($_POST['event_id']);
@@ -178,6 +186,8 @@ if (isset($_POST['edit_event'])) {
 
 if (isset($_GET['delete_event'])) {
 
+    validateCSRFToken($_GET['csrf_token']);
+
     $event_id = intval($_GET['delete_event']);
 
     // Get Event Title