Add CSRF protection to every form that changes data.

The logout link carries the token too, and the cookies get SameSite=Lax.
2026-09-25 21:38:22 +02:00
parent f6bdf10228
commit 41c46a43c6
9 changed files with 53 additions and 5 deletions
@@ -7,6 +7,11 @@ include_once('../session.lib.php');
 if ( ! isset($_SERVER['HTTPS'])) {
   header('Location: https://' . $_SERVER["SERVER_NAME"] . $_SERVER['REQUEST_URI']);
 }
+// Only log out from our own logout link, which carries the CSRF token
+if (!csrf_valid($_GET['token'] ?? '')) {
+  header("Location: https://xxx.org.za/");
+  exit;
+}
 if (isset($_SESSION['editor'])) {
  if (isset($_COOKIE[session_name()])) {
    setcookie(session_name(), '', strtotime('-1 day'), '/');