Changeset 153

Timestamp:

Oct 14, 2012, 8:35:58 PM (12 years ago)

Author:

luciano

Message:

Protezione cfrs.
Per aggiungere un input token ai form
Aggiunge il campo secret alla tabella _config per la creazione del token

Location:

trunk/client

Files:

• inc/csrf-magic (added)
• inc/csrf-magic/csrf-magic.php (added)
• modules.php (modified) (4 diffs)

trunk/client/modules.php

@@ -1 +1 @@
 <?php
-
 
 /************************************************************************/
@@ -12 +11 @@
 
 // Additional security (Union, CLike, XSS)
-
 // We want to use the function stripos,
 // but thats only available since PHP5.
@@ -105 +103 @@
 }
 mysql_query("SET NAMES 'utf8'", $dbi);
+
+# protezione csrf ottobre 2012 - by l.apolito
+if (file_exists("inc/csrf-magic/csrf-magic.php")) {
+        include_once 'inc/csrf-magic/csrf-magic.php';
+}
+
+
+
+
+
 
 # carica i parametri di default sulla tabella
@@ -220 +228 @@
 $file=(isset($_GET['file'])) ? htmlentities($_GET['file']):"index";
 $name=(isset($_GET['name'])) ? htmlentities($_GET['name']):"Elezioni";
+$op=(isset($_GET['op'])) ? htmlentities($_GET['op']):"gruppo";
 if (!isset($_GET['op'])) $_GET['op']="gruppo";