fabs/ZapMachine
1
0
Fork 0
Code Issues Pull requests Projects Releases 1 Packages Wiki Activity Actions

wrong mode in index.php now gives a 404 error (#15); anti cross-site-request token

Browse source
This commit is contained in:
Fabian de Boer 2026-07-19 21:27:13 +02:00
commit ab0ac45415
4 changed files with 48 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
lib/ZAPController.class.php
View file

@ -26,7 +26,9 @@ class ZAPController {
$this->mode = ucfirst($mode);
$clazz = $this->prefix . $this->mode;
if (!class_exists($clazz)) {
die('Wrong parameter');
http_response_code(404);
include getZAPTemplate('404');
die();
}
$this->action = new $clazz();
}

12
lib/ZAPDisplay.class.php
View file

@ -28,6 +28,18 @@ class ZAPDisplay implements ZAPHandler {
*/
public function __construct() {
ob_start();
// Validate CSRF token
if (
empty($_POST['csrf_token'])
|| empty($_SESSION['csrf_token'])
|| !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])
) {
http_response_code(400);
echo '<p>Invalid or missing security token. Please go back and try again.</p>';
die();
}
$this->folder = $this->createFolder();
$this->words = $this->handleWords();

29
tpl/404.tpl Normal file
View file

@ -0,0 +1,29 @@
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>404 - ZapMachine</title>
<link rel="stylesheet" media="screen" href="css/style.css">
<style>
.error-404 {
position: absolute;
top: 50%;
left: 50%;
transform: translate(-50%, -50%);
width: 50vw;
height: 50vh;
display: flex;
align-items: center;
justify-content: center;
font-family: Georgia, serif;
font-size: clamp(2rem, 8vw, 6rem);
color: #555;
border: 0px;
background: #fafafa;
}
</style>
</head>
<body>
<div class="error-404">error 404</div>
</body>
</html>

4
tpl/index.tpl
View file

@ -12,7 +12,11 @@
<!--input modus: words-->
<div id="inpWords" class="inpSection">
<h2>Input words</h2>
<?php if (empty($_SESSION['csrf_token'])) {
$_SESSION['csrf_token'] = bin2hex(random_bytes(16));
} ?>
<form id="form1" action="index.php?mode=display" method="post">
<input type="hidden" name="csrf_token" value="<?= $_SESSION['csrf_token'] ?>">
<?php for ($i = 1; $i <= MAX_WORDS; $i++) : ?>
<?php $nr = sprintf("%02d", $i); ?>
<div class="inp">