X-Git-Url: http://git.polytechnique.org/?a=blobdiff_plain;f=modules%2Fxnet.php;h=c8e5611df0a9303cde1c8e0266a0cc1ecf3c087e;hb=afada5eb6cf23005f775fbab0d421c27393172f1;hp=d592f5b020ee450d764aecd382aa006a17d492f6;hpb=d0327f6de73e81c4bcc656471ca4161e4f1e1e1b;p=platal.git

diff --git a/modules/xnet.php b/modules/xnet.php
index d592f5b..c8e5611 100644
--- a/modules/xnet.php
+++ b/modules/xnet.php
@@ -81,6 +81,8 @@ class XnetModule extends PLModule
             list($id, $nom, $domain) = $res->fetchOneRow();
             $page->assign('nom', $nom);
             if ($id && Post::has('del')) {
+                S::assert_xsrf_token();
+
                 XDB::query('DELETE FROM groupex.membres WHERE asso_id={?}', $id);
                 $page->trig('membres supprimés');
 
@@ -110,6 +112,8 @@ class XnetModule extends PLModule
         }
 
         if (Post::has('diminutif')) {
+            S::assert_xsrf_token();
+
             XDB::query('INSERT INTO groupex.asso (id,diminutif)
                                  VALUES(NULL,{?})', Post::v('diminutif'));
             pl_redirect('../'.Post::v('diminutif').'/edit');