From 7f2ac0c0c28f43d9ef7b7617670b54d5b7670519 Mon Sep 17 00:00:00 2001
From: Max Pozdeev <maxpozdeev@gmail.com>
Date: Mon, 20 Sep 2021 00:57:58 +0300
Subject: [PATCH] * make settings safer

---
 src/includes/mytinytodo.js | 2 +-
 src/settings.php           | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/includes/mytinytodo.js b/src/includes/mytinytodo.js
index 0a9b042..4343bfc 100644
--- a/src/includes/mytinytodo.js
+++ b/src/includes/mytinytodo.js
@@ -2415,7 +2415,7 @@ function saveSettings(frm)
 {
 	if(!frm) return false;
 	var params = { save:'ajax' };
-	$(frm).find("input:text,input:password,input:checked,select").filter(":enabled").each(function() { params[this.name || '__'] = this.value; });
+	$(frm).find("input:hidden,input:text,input:password,input:checked,select").filter(":enabled").each(function() { params[this.name || '__'] = this.value; });
 	$(frm).find(":submit").attr('disabled','disabled').blur();
 	$.post(_mtt.mttUrl+'settings.php', params, function(json){
 		if(json.saved) {
diff --git a/src/settings.php b/src/settings.php
index 890e60a..a7cb9d4 100644
--- a/src/settings.php
+++ b/src/settings.php
@@ -17,6 +17,10 @@ if ( !is_logged() )
 
 if(isset($_POST['save']))
 {
+	if (need_auth() && _post('_token') != hash('gost', session_id())) {
+		die("Access denied! Try to reload the settings page.");
+	}
+
 	$t = array();
 	$langs = getLangs();
 	Config::$params['lang']['options'] = array_keys($langs);
@@ -180,6 +184,7 @@ header('Content-type:text/html; charset=utf-8');
 <div id="settings_msg" style="display:none"></div>
 
 <form id="settings_form" method="post" action="settings.php">
+<input type="hidden" name="_token" value="<?php if(need_auth()) echo htmlspecialchars(hash('gost',session_id())) ?>">
 
 <table class="mtt-settings-table">