diff --git a/lib/ZAPController.class.php b/lib/ZAPController.class.php
index 115b416..29df4c8 100755
--- a/lib/ZAPController.class.php
+++ b/lib/ZAPController.class.php
@@ -26,7 +26,9 @@ class ZAPController {
$this->mode = ucfirst($mode);
$clazz = $this->prefix . $this->mode;
if (!class_exists($clazz)) {
- die('Wrong parameter');
+ http_response_code(404);
+ include getZAPTemplate('404');
+ die();
}
$this->action = new $clazz();
}
diff --git a/lib/ZAPDisplay.class.php b/lib/ZAPDisplay.class.php
index 9cfe2c2..65656e9 100755
--- a/lib/ZAPDisplay.class.php
+++ b/lib/ZAPDisplay.class.php
@@ -28,6 +28,18 @@ class ZAPDisplay implements ZAPHandler {
*/
public function __construct() {
ob_start();
+
+ // Validate CSRF token
+ if (
+ empty($_POST['csrf_token'])
+ || empty($_SESSION['csrf_token'])
+ || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])
+ ) {
+ http_response_code(400);
+ echo 'Invalid or missing security token. Please go back and try again.
';
+ die();
+ }
+
$this->folder = $this->createFolder();
$this->words = $this->handleWords();
diff --git a/tpl/404.tpl b/tpl/404.tpl
new file mode 100644
index 0000000..68649d5
--- /dev/null
+++ b/tpl/404.tpl
@@ -0,0 +1,29 @@
+
+
+
+
+ 404 - ZapMachine
+
+
+
+
+ error 404
+
+
diff --git a/tpl/index.tpl b/tpl/index.tpl
index a5fc6f4..249b112 100755
--- a/tpl/index.tpl
+++ b/tpl/index.tpl
@@ -12,7 +12,11 @@