sec(Reports) CSRF in actions CWE-352

tsolucio · Dec 27, 2021 · 6da824a · 6da824a
1 parent aac4d0d
commit 6da824a
Show file tree

Hide file tree

Showing 5 changed files with 5 additions and 4 deletions.
diff --git a/modules/Reports/ChangeFolder.php b/modules/Reports/ChangeFolder.php
@@ -10,7 +10,7 @@
 require_once 'include/logging.php';
 require_once 'include/database/PearDatabase.php';
 $folderid = vtlib_purify($_REQUEST['folderid']);
-
+Vtiger_Request::validateRequest();
 if (isset($_REQUEST['idlist']) && $_REQUEST['idlist']!= '') {
 	$id_array = array();
 	$id_array = explode(':', $_REQUEST['idlist']);

diff --git a/modules/Reports/Delete.php b/modules/Reports/Delete.php
@@ -12,7 +12,7 @@
 require_once 'include/database/PearDatabase.php';
 
 global $current_user,$adb;
-
+Vtiger_Request::validateRequest();
 if (isset($_REQUEST['idlist']) && $_REQUEST['idlist']!= '') {
 	$id_array = array();
 	$id_array = explode(':', $_REQUEST['idlist']);

diff --git a/modules/Reports/DeleteReportFolder.php b/modules/Reports/DeleteReportFolder.php
@@ -11,7 +11,7 @@
 require_once 'include/database/PearDatabase.php';
 
 global $adb,$mod_strings;
-
+Vtiger_Request::validateRequest();
 $local_log = LoggerManager::getLogger('index');
 $rfid = vtlib_purify($_REQUEST['record']);
 if ($rfid != '') {

diff --git a/modules/Reports/DuplicateReport.php b/modules/Reports/DuplicateReport.php
@@ -12,7 +12,7 @@
 require_once 'include/database/PearDatabase.php';
 
 global $adb,$mod_strings,$app_strings;
-
+Vtiger_Request::validateRequest();
 $reportid = vtlib_purify($_REQUEST['record']);
 $newreportname = vtlib_purify($_REQUEST['newreportname']);
 $newreportdescription = vtlib_purify($_REQUEST['newreportdescription']);

diff --git a/modules/Reports/SaveReportFolder.php b/modules/Reports/SaveReportFolder.php
@@ -12,6 +12,7 @@
 require_once 'include/database/PearDatabase.php';
 
 global $adb, $default_charset;
+Vtiger_Request::validateRequest();
 $local_log = LoggerManager::getLogger('index');
 $focus = new Reports();