From b57e3b0e2f23dd59325fb0026944bba0acebecda Mon Sep 17 00:00:00 2001 From: Erik Dubbelboer Date: Wed, 8 Sep 2021 07:42:57 +0000 Subject: [PATCH] Fix CSRF bugs --- includes/header.inc.php | 4 ++++ index.php | 2 +- js/frame.js | 2 +- js/index.js | 6 +++--- 4 files changed, 9 insertions(+), 5 deletions(-) diff --git a/includes/header.inc.php b/includes/header.inc.php index aa618f1..9602370 100644 --- a/includes/header.inc.php +++ b/includes/header.inc.php @@ -35,5 +35,9 @@ + + diff --git a/index.php b/index.php index 933796a..deee99c 100644 --- a/index.php +++ b/index.php @@ -245,7 +245,7 @@ function getDbInfo($d, $info, $padding = '') {

diff --git a/js/frame.js b/js/frame.js index b3b84b5..1a77e34 100644 --- a/js/frame.js +++ b/js/frame.js @@ -18,7 +18,7 @@ $(function() { $.ajax({ type: "POST", url: this.href, - data: 'post=1', + data: 'post=1&csrf=' + phpRedisAdmin_csrfToken, success: function(url) { top.location.href = top.location.pathname+url; } diff --git a/js/index.js b/js/index.js index 3557014..a3ba627 100644 --- a/js/index.js +++ b/js/index.js @@ -28,7 +28,7 @@ $(function() { $.ajax({ type: "POST", url: this.href, - data: 'post=1&selected_keys=' + selected_keys, + data: 'post=1&selected_keys=' + selected_keys + '&csrf=' + phpRedisAdmin_csrfToken, success: function(url) { top.location.href = top.location.pathname+url; } @@ -41,7 +41,7 @@ $(function() { $.ajax({ type: "POST", url: this.href, - data: 'post=1', + data: 'post=1&csrf=' + phpRedisAdmin_csrfToken, success: function(url) { top.location.href = top.location.pathname+url; } @@ -74,7 +74,7 @@ $(function() { $.ajax({ type: "POST", url: href, - data: 'post=1', + data: 'post=1&csrf=' + phpRedisAdmin_csrfToken, success: function() { window.location.reload(); }