X-Git-Url: http://git.polytechnique.org/?a=blobdiff_plain;f=modules%2Fxnetevents.php;h=6ee5456e72d2ccd45244b200f7d9ee83d1b38357;hb=63f06a435ff8e9c058b1dee1eb97fff99606d490;hp=417fb3f9e2032a12b8a24431e1aa62977315e948;hpb=a7d35093a40837b3a17d7fbac0259995f084812c;p=platal.git

diff --git a/modules/xnetevents.php b/modules/xnetevents.php
index 417fb3f..6ee5456 100644
--- a/modules/xnetevents.php
+++ b/modules/xnetevents.php
@@ -58,6 +58,7 @@ class XnetEventsModule extends PLModule
             if (!may_update()) {
                 return PL_FORBIDDEN;
             }
+            S::assert_xsrf_token();
 
             $res = XDB::query("SELECT asso_id, short_name FROM groupex.evenements
                                 WHERE eid = {?} AND asso_id = {?}",
@@ -97,7 +98,7 @@ class XnetEventsModule extends PLModule
             XDB::execute("DELETE FROM requests
                                     WHERE type = 'paiements' AND data LIKE {?}",
                                    PayReq::same_event($eid, $globals->asso('id')));
-            update_NbValid();
+            $globals->updateNbValid();
         }
 
         if ($action == 'archive') {
@@ -202,6 +203,8 @@ class XnetEventsModule extends PLModule
 
         if (!Post::has('submit')) {
             return;
+        } else {
+            S::assert_xsrf_token();
         }
 
         $moments = Post::v('moment',    array());
@@ -361,6 +364,8 @@ class XnetEventsModule extends PLModule
         $page->assign('moments', $moments);
 
         if (Post::v('intitule')) {
+            S::assert_xsrf_token();
+
             require_once dirname(__FILE__).'/xnetevents/xnetevents.inc.php';
             $short_name = event_change_shortname($page, $eid,
                                                  $infos['short_name'],
@@ -525,6 +530,8 @@ class XnetEventsModule extends PLModule
         }
 
         if (may_update() && Post::v('adm')) {
+            S::assert_xsrf_token();
+
             $member = get_infos(Post::v('mail'));
             if (!$member) {
                 $page->trigError("Membre introuvable");