fabs/ZapMachine
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

wrong mode in index.php now gives a 404 error (#15); anti cross-site-request token

Browse source
This commit is contained in:
Fabian de Boer 2026-07-19 21:27:13 +02:00
commit ab0ac45415
4 changed files with 48 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

12
lib/ZAPDisplay.class.php
View file

@ -28,6 +28,18 @@ class ZAPDisplay implements ZAPHandler {
*/
public function __construct() {
ob_start();
// Validate CSRF token
if (
empty($_POST['csrf_token'])
|| empty($_SESSION['csrf_token'])
|| !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])
) {
http_response_code(400);
echo '<p>Invalid or missing security token. Please go back and try again.</p>';
die();
}
$this->folder = $this->createFolder();
$this->words = $this->handleWords();