if (!may_update()) {
return PL_FORBIDDEN;
}
+ S::assert_xsrf_token();
$res = XDB::query("SELECT asso_id, short_name FROM groupex.evenements
WHERE eid = {?} AND asso_id = {?}",
XDB::execute("DELETE FROM requests
WHERE type = 'paiements' AND data LIKE {?}",
PayReq::same_event($eid, $globals->asso('id')));
- update_NbValid();
+ $globals->updateNbValid();
}
if ($action == 'archive') {
if (!Post::has('submit')) {
return;
+ } else {
+ S::assert_xsrf_token();
}
$moments = Post::v('moment', array());
$page->assign('moments', $moments);
if (Post::v('intitule')) {
+ S::assert_xsrf_token();
+
require_once dirname(__FILE__).'/xnetevents/xnetevents.inc.php';
$short_name = event_change_shortname($page, $eid,
$infos['short_name'],
}
if (may_update() && Post::v('adm')) {
+ S::assert_xsrf_token();
+
$member = get_infos(Post::v('mail'));
if (!$member) {
$page->trigError("Membre introuvable");