prehistoric-systems/mytinytodo
1
0
Fork 0
mirror of https://github.com/maxpozdeev/mytinytodo.git synced 2026-03-11 08:55:27 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

* make settings safer

Browse source
This commit is contained in:
Max Pozdeev 2021-09-20 00:57:58 +03:00
parent 03d890c418
commit 7f2ac0c0c2
2 changed files with 6 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/includes/mytinytodo.js
View file

@ -2415,7 +2415,7 @@ function saveSettings(frm)
{
if(!frm) return false;
var params = { save:'ajax' };
$(frm).find("input:text,input:password,input:checked,select").filter(":enabled").each(function() { params[this.name || '__'] = this.value; });
$(frm).find("input:hidden,input:text,input:password,input:checked,select").filter(":enabled").each(function() { params[this.name || '__'] = this.value; });
$(frm).find(":submit").attr('disabled','disabled').blur();
$.post(_mtt.mttUrl+'settings.php', params, function(json){
if(json.saved) {

5
src/settings.php
View file

@ -17,6 +17,10 @@ if ( !is_logged() )
if(isset($_POST['save']))
{
if (need_auth() && _post('_token') != hash('gost', session_id())) {
die("Access denied! Try to reload the settings page.");
}
$t = array();
$langs = getLangs();
Config::$params['lang']['options'] = array_keys($langs);
@ -180,6 +184,7 @@ header('Content-type:text/html; charset=utf-8');
<div id="settings_msg" style="display:none"></div>
<form id="settings_form" method="post" action="settings.php">
<input type="hidden" name="_token" value="<?php if(need_auth()) echo htmlspecialchars(hash('gost',session_id())) ?>">
<table class="mtt-settings-table">