github/myvesta
1
0
Fork 0
mirror of https://github.com/myvesta/vesta synced 2025-08-14 10:37:42 -07:00
Code Issues Projects Releases Packages Wiki Activity Actions

Fix for CSRF in FileManager and UploadHandler

Browse source
This commit is contained in:
myvesta 2021-09-04 15:31:34 +02:00
commit 93de22a0b3
6 changed files with 29 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

4
web/templates/file_manager/main.php
View file

@ -15,6 +15,7 @@
<script> GLOBAL = {}; </script>
</head>
<body>
<div class="hidden" id="token" token="<?=$_SESSION['token']?>"></div>
<a href="#" class="to-shortcuts">
<i class="l-icon-shortcuts"></i>
</a>
@ -145,6 +146,7 @@
var acc = $('<div>');
$(['A', 'B']).each(function(k, letter) {
var url = '/upload/';
var token = $('#token').attr('token');
$('#file_upload_' + letter).fileupload({
singleFileUploads: false,
add: function (e, data) {
@ -154,7 +156,7 @@
var file_relocation = FM['TAB_'+tab+'_CURRENT_PATH'];
$('#file_upload_' + letter).fileupload("option", "url", url + '?dir=' + file_relocation);
$('#file_upload_' + letter).fileupload("option", "url", url + '?token='+token+'&dir=' + file_relocation);
acc = $('<div>');
show_msg = false;
data.submit();