add inputs to all forms

Author: simonLeary42

resources/templates/header.php

@@ -162,10 +162,12 @@
         && isset($_SESSION["viewUser"])
     ) {
         $viewUser = $_SESSION["viewUser"];
+        $CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
         echo "
           <div id='viewAsBar'>
             <span>You are accessing the web portal as the user <strong>$viewUser</strong></span>
             <form method='POST' action=''>
+              $CSRFTokenHiddenFormInput
               <input type='hidden' name='form_type' value='clearView'>
               <input type='hidden' name='uid' value='$viewUser'>
               <input type='submit' value='Return to My User'>

webroot/admin/ajax/get_group_members.php

@@ -34,6 +34,7 @@
     echo "<td>$uid</td>";
     echo "<td><a href='mailto:$mail'>$mail</a></td>";
     echo "<td>";
+    $CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
     echo "
         <form
             action=''
@@ -42,6 +43,7 @@
                 return confirm(\"Are you sure you want to remove $uid from this group?\");
             '
         >
+        $CSRFTokenHiddenFormInput
         <input type='hidden' name='form_type' value='remUserChild'>
         <input type='hidden' name='uid' value='$uid'>
         <input type='hidden' name='pi' value='$group->gid'>
@@ -65,9 +67,11 @@
     echo "<td>$user->uid</td>";
     echo "<td><a href='mailto:$email'>$email</a></td>";
     echo "<td>";
+    $CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
     echo
         "<form action='' method='POST'
     onsubmit='return confirm(\"Are you sure you want to approve $user->uid ?\");'>
+    $CSRFTokenHiddenFormInput
     <input type='hidden' name='form_type' value='reqChild'>
     <input type='hidden' name='uid' value='$user->uid'>
     <input type='hidden' name='pi' value='$group->gid'>

webroot/admin/content.php

@@ -21,6 +21,7 @@
 <hr>
 
 <form id="pageForm" method="POST" action="">
+    <?php echo UnityHTTPD::getCSRFTokenHiddenFormInput(); ?>
     <select name="pageSel" required>
         <option value="" selected disabled hidden>Select page...</option>
         <?php

webroot/admin/notices.php

@@ -36,6 +36,7 @@
 <button style='display: none;' class='btnClear'>Create New Notice Instead</button>
 
 <form action="" method="POST" id="noticeForm">
+    <?php echo UnityHTTPD::getCSRFTokenHiddenFormInput(); ?>
     <input type="hidden" name=id>
     <input type="hidden" name="form_type" value="newNotice">
     <input type="text" name="title" placeholder="Notice Title">
@@ -62,8 +63,10 @@
     echo "<span class='noticeDate'>" . date('Y-m-d', strtotime($notice["date"])) . "</span>";
     echo "<div class='noticeText'>" . $notice["message"] . "</div>";
     echo "<button class='btnEdit'>Edit</button>";
-    echo
-    "<form style='display: inline-block; margin-left: 10px;' method='POST' action=''>
+    $CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
+    echo "
+    <form style='display: inline-block; margin-left: 10px;' method='POST' action=''>
+    $CSRFTokenHiddenFormInput
     <input type='hidden' name='form_type' value='delNotice'>
     <input type='hidden' name='id' value='" . $notice["id"] . "'>
     <input type='submit' value='Delete'>

webroot/admin/pi-mgmt.php

@@ -76,8 +76,10 @@
         echo "<td><a href='mailto:$email'>$email</a></td>";
         echo "<td>" . date("jS F, Y", strtotime($request['timestamp'])) . "</td>";
         echo "<td>";
+        $CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
         echo
             "<form action='' method='POST'>
+        $CSRFTokenHiddenFormInput
         <input type='hidden' name='form_type' value='req'>
         <input type='hidden' name='uid' value='$uid'>
         <input type='submit' name='action' value='Approve'

webroot/admin/user-mgmt.php

@@ -74,8 +74,10 @@ class="filterSearch"
         }
         echo "</td>";
         echo "<td>";
+        $CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
         echo "<form class='viewAsUserForm' action='' method='POST'
         onsubmit='return confirm(\"Are you sure you want to switch to the user $uid?\");'>
+        $CSRFTokenHiddenFormInput
         <input type='hidden' name='form_type' value='viewAsUser'>
         <input type='hidden' name='uid' value='$uid'>
         <input type='submit' name='action' value='Access'>

webroot/panel/account.php

@@ -158,6 +158,7 @@
             id='piReq'
         >
     ";
+    echo UnityHTTPD::getCSRFTokenHiddenFormInput();
     if ($SQL->accDeletionRequestExists($USER->uid)) {
         echo "<input type='submit' value='Request PI Account' disabled />";
         echo "
@@ -207,6 +208,7 @@
 }
 
 for ($i = 0; $sshPubKeys != null && $i < count($sshPubKeys); $i++) {
+    $CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
     echo
     "<div class='key-box'>
         <textarea spellcheck='false' readonly>" . $sshPubKeys[$i] . "</textarea>
@@ -215,28 +217,31 @@
             onsubmit='return confirm(\"Are you sure you want to delete this SSH key?\");'
             method='POST'
         >
+            $CSRFTokenHiddenFormInput
             <input type='hidden' name='delIndex' value='$i' />
             <input type='hidden' name='form_type' value='delKey' />
             <input type='submit' value='&times;' />
         </form>
     </div>";
 }
 
-echo '
-    <button type="button" class="plusBtn btnAddKey"><span>&#43;</span></button>
+$CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
+echo "
+    <button type='button' class='plusBtn btnAddKey'><span>&#43;</span></button>
     <hr>
     <h5>Login Shell</h5>
-    <form action="" method="POST">
-    <input type="hidden" name="form_type" value="loginshell" />
-    <select id="loginSelector" class="code" name="shellSelect">
-';
+    <form action='' method='POST'>
+      $CSRFTokenHiddenFormInput
+      <input type='hidden' name='form_type' value='loginshell' />
+      <select id='loginSelector' class='code' name='shellSelect'>
+";
 foreach (CONFIG["loginshell"]["shell"] as $shell) {
     echo "<option>$shell</option>";
 }
 echo "
-    </select>
-    <br>
-    <input id='submitLoginShell' type='submit' value='Set Login Shell' />
+      </select>
+      <br>
+      <input id='submitLoginShell' type='submit' value='Set Login Shell' />
     </form>
     <hr>
     <h5>Account Deletion</h5>
@@ -245,13 +250,15 @@
 if ($hasGroups) {
     echo "<p>You cannot request to delete your account while you are in a PI group.</p>";
 } else {
+    $CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
     echo "
         <form
             action=''
             method='POST'
             id='accDel'
             onsubmit='return confirm(\"Are you sure you want to request an account deletion?\")'
         >
+        $CSRFTokenHiddenFormInput
         <input type='hidden' name='form_type' value='account_deletion_request' />
     ";
     if ($SQL->accDeletionRequestExists($USER->uid)) {

webroot/panel/groups.php

@@ -102,7 +102,9 @@
         echo "<td><a href='mailto:$mail'>$mail</a></td>";
         echo "<td>" . date("jS F, Y", strtotime($request['timestamp'])) . "</td>";
         echo "<td>";
+        $CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
         echo "<form action='' method='POST' id='cancelPI'>
+            $CSRFTokenHiddenFormInput
             <input type='hidden' name='pi' value='{$requested_account->gid}'>
             <input type='hidden' name='form_type' value='cancelPIForm'>
             <input name='cancel' style='margin-top: 10px;' type='submit' value='Cancel Request'/>
@@ -148,10 +150,12 @@
     echo "<td><button class='btnExpand'>&#9654;</button>$full_name</td>";
     echo "<td>" . $group->gid . "</td>";
     echo "<td><a href='mailto:" . $owner->getMail() . "'>" . $owner->getMail() . "</a></td>";
+    $CSRFTokenHiddenFormInput = UnityHTTPD::getCSRFTokenHiddenFormInput();
     echo
         "<td>
     <form action='' method='POST'
     onsubmit='return confirm(\"Are you sure you want to leave the PI group " . $group->gid . "?\")'>
+    $CSRFTokenHiddenFormInput
     <input type='hidden' name='form_type' value='removePIForm'>
     <input type='hidden' name='pi' value='" . $group->gid . "'>
     <input type='submit' value='Leave Group'>

webroot/panel/modal/new_key.php

@@ -5,6 +5,7 @@
 
 <form id="newKeyform" enctype="multipart/form-data" method="POST"
 action="<?php echo CONFIG["site"]["prefix"]; ?>/panel/account.php">
+    <?php echo UnityHTTPD::getCSRFTokenHiddenFormInput(); ?>
     <input type='hidden' name='form_type' value='addKey'>
 
     <div class='inline'>

webroot/panel/modal/new_pi.php

@@ -8,6 +8,7 @@
     method="POST"
     action="<?php echo CONFIG["site"]["prefix"]; ?>/panel/groups.php"
 >
+    <?php echo UnityHTTPD::getCSRFTokenHiddenFormInput(); ?>
     <input type="hidden" name="form_type" value="addPIform">
     <div style="position: relative;">
         <input type="text" id="pi_search" name="pi" placeholder="Search PI by NetID" required>