From 721dfabba8fa361ffa768739330d93efee6c35a0 Mon Sep 17 00:00:00 2001
From: Kestas Kuliukas <kestas.j.k@gmail.com>
Date: Fri, 23 Jul 2021 21:47:19 +0800
Subject: [PATCH] XSS fix

---
 gamepanel/gamehome.php | 2 ++
 index.php              | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/gamepanel/gamehome.php b/gamepanel/gamehome.php
index 5f7e9ce6a..f07091194 100755
--- a/gamepanel/gamehome.php
+++ b/gamepanel/gamehome.php
@@ -196,6 +196,7 @@ function links()
 			{
 				return '<div class="bar homeGameLinks barAlt'.libHTML::alternate().'">
 				<form action="#" method="post">
+				'.libAuth::formTokenHTML().'
 					<a href="board.php?gameID='.$this->id.'">'.l_t('Open').'</a>
 					<input type="hidden" value="'.$this->id.'" name="gameToggleName" />
 					<input type="submit" title="Turn on/off the notifications for this game." style="float: right;" class = "home-submit toggle-notice" name="submit" value="'.$SubmitName.'"/>
@@ -207,6 +208,7 @@ function links()
 				return '<div class="bar homeGameLinks barAlt'.libHTML::alternate().'">
 					
 					<form action="#" method="post">
+					'.libAuth::formTokenHTML().'
 					<a href="board.php?gameID='.$this->id.'#gamePanel">'.l_t('Open').'</a> 
 					<input type="hidden" value="'.$this->id.'" name="gameToggleName" />
 					<input type="submit" title="Turn on/off the notifications for this game." style="float: right;" class = "home-submit toggle-notice" name="submit" value="'.$SubmitName.'"/>
diff --git a/index.php b/index.php
index 7d9aad9f1..16ad09a62 100755
--- a/index.php
+++ b/index.php
@@ -52,6 +52,8 @@
 
 	if ($User->type['User'] and $gameToggleID > 0)
 	{
+		libAuth::formToken_Valid();
+		
 		$noticesStatus = 5;
 		list($noticesStatus) = $DB->sql_row("SELECT hideNotifications FROM wD_Members WHERE userID =".$User->id." and gameID =".$gameToggleID);