fabs/ZapMachine
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

wrong mode in index.php now gives a 404 error (#15); anti cross-site-request token

Browse source
This commit is contained in:
Fabian de Boer 2026-07-19 21:27:13 +02:00
commit ab0ac45415
4 changed files with 48 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/ZAPController.class.php
View file

@ -26,7 +26,9 @@ class ZAPController {
$this->mode = ucfirst($mode);
$clazz = $this->prefix . $this->mode;
if (!class_exists($clazz)) {
die('Wrong parameter');
http_response_code(404);
include getZAPTemplate('404');
die();
}
$this->action = new $clazz();
}

12
lib/ZAPDisplay.class.php
View file

@ -28,6 +28,18 @@ class ZAPDisplay implements ZAPHandler {
*/
public function __construct() {
ob_start();
// Validate CSRF token
if (
empty($_POST['csrf_token'])
|| empty($_SESSION['csrf_token'])
|| !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])
) {
http_response_code(400);
echo '<p>Invalid or missing security token. Please go back and try again.</p>';
die();
}
$this->folder = $this->createFolder();
$this->words = $this->handleWords();