CSFR Token expire cache

LiveHelperChat · Dec 17, 2021 · 3b5d0a8 · 3b5d0a8
1 parent 0f45fe4
commit 3b5d0a8
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 2 deletions.
diff --git a/lhc_web/design/defaulttheme/tpl/lhsystem/configuration_links/expirecache.tpl.php b/lhc_web/design/defaulttheme/tpl/lhsystem/configuration_links/expirecache.tpl.php
@@ -1,3 +1,3 @@
 <?php if ($currentUser->hasAccessTo('lhsystem','expirecache')) : ?>		
-	<li><a href="<?php echo erLhcoreClassDesign::baseurl('system/expirecache')?>"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Clean cache');?></a></li>			
+	<li><a class="csfr-required" href="<?php echo erLhcoreClassDesign::baseurl('system/expirecache')?>"><?php echo erTranslationClassLhTranslation::getInstance()->getTranslation('pagelayout/pagelayout','Clean cache');?></a></li>
 <?php endif; ?>
diff --git a/lhc_web/modules/lhsystem/expirecache.php b/lhc_web/modules/lhsystem/expirecache.php
@@ -1,5 +1,11 @@
 <?php
 
+$currentUser = erLhcoreClassUser::instance();
+
+if (!$currentUser->validateCSFRToken($Params['user_parameters_unordered']['csfr'])) {
+    die('Invalid CSFR Token');
+    exit;
+}
 
 $CacheManager = erConfigClassLhCacheConfig::getInstance();
 $CacheManager->expireCache(true);

diff --git a/lhc_web/modules/lhsystem/module.php b/lhc_web/modules/lhsystem/module.php
@@ -36,7 +36,8 @@
 
 $ViewList['expirecache'] = array(
     'params' => array(),
-    'functions' => array( 'expirecache' )
+    'functions' => array( 'expirecache' ),
+    'uparams' => array('csfr')
 );
 
 $ViewList['smtp'] = array(