validate in all pages

Author: simonLeary42

webroot/admin/ajax/get_group_members.php

@@ -13,6 +13,10 @@
     UnityHTTPD::badRequest("PI UID not set");
 }
 
+if ($_SERVER["REQUEST_METHOD"] == "POST") {
+    UnityHTTPD::validatePostCSRFToken();
+}
+
 $group = new UnityGroup($_GET["gid"], $LDAP, $SQL, $MAILER, $WEBHOOK);
 $members = $group->getGroupMembersAttributes(["gecos", "mail"]);
 $requests = $group->getRequests();

webroot/admin/content.php

@@ -9,6 +9,7 @@
 }
 
 if ($_SERVER["REQUEST_METHOD"] == "POST") {
+    UnityHTTPD::validatePostCSRFToken();
     if (!empty($_POST["pageSel"])) {
         $SQL->editPage($_POST["pageSel"], $_POST["content"], $USER);
     }

webroot/admin/notices.php

@@ -9,6 +9,7 @@
 }
 
 if ($_SERVER["REQUEST_METHOD"] == "POST") {
+    UnityHTTPD::validatePostCSRFToken();
     switch ($_POST["form_type"]) {
         case "newNotice":
             $SQL->addNotice($_POST["title"], $_POST["date"], $_POST["content"], $USER);

webroot/admin/pi-mgmt.php

@@ -12,6 +12,7 @@
 }
 
 if ($_SERVER["REQUEST_METHOD"] == "POST") {
+    UnityHTTPD::validatePostCSRFToken();
     if (isset($_POST["uid"])) {
         $form_user = new UnityUser($_POST["uid"], $LDAP, $SQL, $MAILER, $WEBHOOK);
     }

webroot/admin/user-mgmt.php

@@ -9,6 +9,7 @@
 }
 
 if ($_SERVER["REQUEST_METHOD"] == "POST") {
+    UnityHTTPD::validatePostCSRFToken();
     switch ($_POST["form_type"]) {
         case "viewAsUser":
             $_SESSION["viewUser"] = $_POST["uid"];

webroot/panel/account.php

@@ -10,6 +10,7 @@
 $hasGroups = count($USER->getPIGroupGIDs()) > 0;
 
 if ($_SERVER['REQUEST_METHOD'] == "POST") {
+    UnityHTTPD::validatePostCSRFToken();
     switch (UnityHTTPD::getPostData("form_type")) {
         case "addKey":
             $keys = array();

webroot/panel/groups.php

@@ -7,6 +7,7 @@
 use UnityWebPortal\lib\UnityHTTPD;
 
 if ($_SERVER["REQUEST_METHOD"] == "POST") {
+    UnityHTTPD::validatePostCSRFToken();
     if (isset($_POST["form_type"])) {
         if (isset($_POST["pi"])) {
             $pi_groupname = $_POST["pi"];

webroot/panel/new_account.php

@@ -9,6 +9,7 @@
     UnityHTTPD::redirect(CONFIG["site"]["prefix"] . "/panel/account.php");
 }
 if ($_SERVER["REQUEST_METHOD"] == "POST") {
+    UnityHTTPD::validatePostCSRFToken();
     $user = new UnityUser($SSO["user"], $LDAP, $SQL, $MAILER, $WEBHOOK);
     $user->init($SSO["firstname"], $SSO["lastname"], $SSO["mail"], $SSO["org"]);
     // header.php will redirect to this same page again and then this page will redirect to account

webroot/panel/pi.php

@@ -12,6 +12,7 @@
 }
 
 if ($_SERVER["REQUEST_METHOD"] == "POST") {
+    UnityHTTPD::validatePostCSRFToken();
     if (isset($_POST["uid"])) {
         $form_user = new UnityUser($_POST["uid"], $LDAP, $SQL, $MAILER, $WEBHOOK);
     }