From 4fcbb455e9147e719be75e173b076ba0009258b5 Mon Sep 17 00:00:00 2001
From: Vincent Zanotti <vincent.zanotti@polytechnique.org>
Date: Fri, 4 Jul 2008 14:35:17 +0200
Subject: [PATCH] Adds XSRF protection to the XnetEvents module.

Signed-off-by: Vincent Zanotti <vincent.zanotti@polytechnique.org>
---
 modules/xnetevents.php             | 7 +++++++
 templates/xnetevents/admin.tpl     | 2 ++
 templates/xnetevents/edit.tpl      | 1 +
 templates/xnetevents/index.tpl     | 4 ++--
 templates/xnetevents/subscribe.tpl | 1 +
 5 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/modules/xnetevents.php b/modules/xnetevents.php
index 417fb3f..77abf91 100644
--- a/modules/xnetevents.php
+++ b/modules/xnetevents.php
@@ -58,6 +58,7 @@ class XnetEventsModule extends PLModule
             if (!may_update()) {
                 return PL_FORBIDDEN;
             }
+            S::assert_xsrf_token();
 
             $res = XDB::query("SELECT asso_id, short_name FROM groupex.evenements
                                 WHERE eid = {?} AND asso_id = {?}",
@@ -202,6 +203,8 @@ class XnetEventsModule extends PLModule
 
         if (!Post::has('submit')) {
             return;
+        } else {
+            S::assert_xsrf_token();
         }
 
         $moments = Post::v('moment',    array());
@@ -361,6 +364,8 @@ class XnetEventsModule extends PLModule
         $page->assign('moments', $moments);
 
         if (Post::v('intitule')) {
+            S::assert_xsrf_token();
+
             require_once dirname(__FILE__).'/xnetevents/xnetevents.inc.php';
             $short_name = event_change_shortname($page, $eid,
                                                  $infos['short_name'],
@@ -525,6 +530,8 @@ class XnetEventsModule extends PLModule
         }
 
         if (may_update() && Post::v('adm')) {
+            S::assert_xsrf_token();
+
             $member = get_infos(Post::v('mail'));
             if (!$member) {
                 $page->trigError("Membre introuvable");
diff --git a/templates/xnetevents/admin.tpl b/templates/xnetevents/admin.tpl
index 0028619..55b1136 100644
--- a/templates/xnetevents/admin.tpl
+++ b/templates/xnetevents/admin.tpl
@@ -239,6 +239,7 @@ Donne ici son mail, ainsi que le nombre de participants.
 </p>
 
 <form action="{$platal->pl_self()}" method="post" id="inscription">
+  {xsrf_token_field}
   <p class="descr">
     <input type="hidden" name="adm" value="nbs" />
 
@@ -272,6 +273,7 @@ Note que tu peux cliquer sur les noms des membres pour remplir automatiquement l
 </p>
 
 <form action="{$platal->pl_self()}" method="post" id="montant">
+  {xsrf_token_field}
   <p class="descr">
   <input type="hidden" name="adm" value="prix" />
   Mail&nbsp;: <input name="mail" size="20" />
diff --git a/templates/xnetevents/edit.tpl b/templates/xnetevents/edit.tpl
index 5a208cc..85f149f 100644
--- a/templates/xnetevents/edit.tpl
+++ b/templates/xnetevents/edit.tpl
@@ -64,6 +64,7 @@ function deadlineChange(box)
 {/if}
 
 <form method="post" action="{$platal->ns}events/edit/{$url_ref}">
+  {xsrf_token_field}
   <table class='bicol' cellspacing='0' cellpadding='0'>
     <colgroup>
       <col width='25%' />
diff --git a/templates/xnetevents/index.tpl b/templates/xnetevents/index.tpl
index eff4fd5..d090d5c 100644
--- a/templates/xnetevents/index.tpl
+++ b/templates/xnetevents/index.tpl
@@ -73,7 +73,7 @@
         modifier
         {icon name=date_edit title="Édition de l'événement"}</a>]
       &nbsp;
-      [<a href="javascript:dynpostkv('{$platal->pl_self()}', {if !$archive}'archive'{else}'unarchive'{/if}, {$e.eid})">
+      [<a href="javascript:dynpostkv('{$platal->pl_self()}?token={xsrf_token}', {if !$archive}'archive'{else}'unarchive'{/if}, {$e.eid})">
         {if !$archive}
           archiver
           {icon name=package_add title="Archivage"}</a>]
@@ -82,7 +82,7 @@
           {icon name=package_delete title="Désarchivage"}</a>]
         {/if}
       &nbsp;
-      [<a href="javascript:dynpostkv('{$platal->ns}events', 'del', {$e.eid})"
+      [<a href="javascript:dynpostkv('{$platal->ns}events?token={xsrf_token}', 'del', {$e.eid})"
         onclick="return confirm('Supprimer l\'événement effacera la liste des inscrits et des paiements.\n Es-tu sûr de vouloir supprimer l\'événement ?')">
         supprimer
       {icon name=delete title='Suppression'}</a>]
diff --git a/templates/xnetevents/subscribe.tpl b/templates/xnetevents/subscribe.tpl
index e0c9e5d..5faab37 100644
--- a/templates/xnetevents/subscribe.tpl
+++ b/templates/xnetevents/subscribe.tpl
@@ -61,6 +61,7 @@
 {/if}
 
 <form action="{$platal->ns}events/sub/{$event.eid}" method="post">
+  {xsrf_token_field}
   <table class="tiny" cellspacing="0" cellpadding="0">
     {foreach from=$event.moments item=m}
     <tr><th>{$m.titre} ({$m.montant} &euro;)</th></tr>
-- 
2.1.4