diff --git a/Bottom.php b/Bottom.php
index 2ac7dada0..a025eb772 100644
--- a/Bottom.php
+++ b/Bottom.php
@@ -76,7 +76,7 @@
-
+
diff --git a/CHANGES.md b/CHANGES.md
index 96509f3a6..cc668f52c 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -58,7 +58,8 @@ Changes in 9.0
- JS add DOMPurify 2.3.6 in assets/js/DOMPurify/ & Gruntfile.js
- JS fix stored XSS issue related to MarkDown in warehouse.js & plugins.min.js, thanks to @intrapus
- JS remove logged in check on history back in warehouse.js & plugins.min.js
-- Add CSRF token to protect unauthenticated requests in Warehouse.php & login.php, thanks to @khanhchauminh
+- Add CSRF token to protect unauthenticated requests in Warehouse.php & login.php
+- Add CSRF token to logout URL in login.php, Warehouse.php, PasswordReset.php, Bottom.php, Student.php & User.php, thanks to @khanhchauminh
Changes in 8.9.5
----------------
diff --git a/PasswordReset.php b/PasswordReset.php
index 022892071..0089a9272 100644
--- a/PasswordReset.php
+++ b/PasswordReset.php
@@ -109,7 +109,7 @@
if ( ! ROSARIO_DEBUG )
{
// Redirect to login page.
- header( 'Location: index.php?modfunc=logout&reason=password_reset' );
+ header( 'Location: index.php?modfunc=logout&reason=password_reset&token=' . $_SESSION['token'] );
exit;
}
diff --git a/Warehouse.php b/Warehouse.php
index 989d8e10f..3db7dbb24 100644
--- a/Warehouse.php
+++ b/Warehouse.php
@@ -177,7 +177,8 @@
// Redirection is done in Javascript in case current request is AJAX.
?>
+ +
+ "&token=" + ;
-
+
diff --git a/index.php b/index.php
index 6e84f34d8..06c6f7da3 100644
--- a/index.php
+++ b/index.php
@@ -24,9 +24,13 @@
'&redirect_to=' . urlencode( $_REQUEST['redirect_to'] ) :
'' ) );
- session_unset();
+ if ( ! empty( $_REQUEST['token'] )
+ && $_SESSION['token'] === $_REQUEST['token'] )
+ {
+ session_unset();
- session_destroy();
+ session_destroy();
+ }
exit;
}
@@ -83,7 +87,7 @@
if ( ! isset( $_COOKIE['RosarioSIS'] )
&& ! isset( $_COOKIE[ $default_session_name ] ) )
{
- header( 'Location: index.php?modfunc=logout&reason=cookie' );
+ header( 'Location: index.php?modfunc=logout&reason=cookie&token=' . $_SESSION['token'] );
exit;
}
diff --git a/modules/Users/User.php b/modules/Users/User.php
index af5d1c1c0..18906ad5e 100644
--- a/modules/Users/User.php
+++ b/modules/Users/User.php
@@ -536,7 +536,7 @@
{
// Account created, return to index.
?>
-
+