franzz/spot
1
0
Fork 0
Code Issues Pull Requests Actions Releases Wiki Activity

Implement CSRF
All checks were successful
Deploy Spot / deploy (push) Successful in 34s
Details

Browse Source
This commit is contained in:
Franzz
2026-05-28 13:22:44 +02:00
parent 8092846d6f
commit fdd0ada815
14 changed files with 129 additions and 106 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
lib/Spot.php
View File

@@ -46,6 +46,19 @@ class Spot extends Main
const MAIN_PAGE = 'index';
const DIST_FOLDER = '../dist/';
const MUTATING_ACTIONS = array(
'add_post',
'subscribe',
'unsubscribe',
'update_project',
'upload',
'add_comment',
'add_position',
'admin_set',
'admin_create',
'admin_delete',
'build_geojson'
);
private Project $oProject;
private Media $oMedia;
@@ -186,7 +199,8 @@ class Spot extends Main
'chunk_size' => self::FEED_CHUNK_SIZE,
'hash_sep' => '-',
'title' => self::PROJECT_NAME,
'default_page' => 'project'
'default_page' => 'project',
'csrf_token' => $this->getCsrfToken()
)
),
self::MAIN_PAGE,
@@ -278,17 +292,6 @@ class Spot extends Main
return $oEmail->send();
}
public function genCronFile() {
//$bSuccess = (file_put_contents('spot_cron.sh', '#!/bin/bash'."\n".'cd '.dirname($_SERVER['SCRIPT_FILENAME'])."\n".'php -f index.php a=update_feed')!==false);
$sFileName = 'spot_cron.sh';
$sContent =
'#!/bin/bash'."\n".
'wget -qO- '.$this->asContext['serv_name'].'index.php?a=update_project > /dev/null'."\n".
'#Crontab job: 0 * * * * . '.dirname($_SERVER['SCRIPT_FILENAME']).'/'.$sFileName.' > /dev/null'."\n";
$bSuccess = (file_put_contents($sFileName, $sContent)!==false);
return self::getJsonResult($bSuccess, '');
}
public function getMarkers($asMessageIds=array(), $asMediaIds=array(), $bInternal=false)
{
//Get messages
@@ -579,10 +582,10 @@ class Spot extends Main
return $bInternal?$asResult['feed']:self::getJsonResult(true, '', $asResult);
}
public function getFeed($iRefId=0, $sDirection, $sSort) {
$this->oDb->cleanSql($iRefId);
$this->oDb->cleanSql($sDirection);
$this->oDb->cleanSql($sSort);
private function getFeed($iRefId, $sDirection, $sSort) {
$sRefId = is_scalar($iRefId) && preg_match('/^\d+(?:\.\d+)?$/D', (string) $iRefId) ? (string) $iRefId : '0';
$sDirection = ($sDirection === '>')?'>':'<';
$sSort = ($sSort === 'ASC')?'ASC':'DESC';
$sProjectIdField = Db::getId(Project::PROJ_TABLE);
$sMsgIdField = Db::getId(Feed::MSG_TABLE);
@@ -605,7 +608,7 @@ class Spot extends Main
"FROM ".self::POST_TABLE,
$this->getFeedConstraints(self::POST_TABLE, 'site_time', 'sql'),
") AS items",
($iRefId > 0)?("WHERE ref ".$sDirection." ".$iRefId):"",
($sRefId !== '0')?("WHERE ref ".$sDirection." ".$sRefId):"",
"ORDER BY ref ".$sSort,
"LIMIT ".self::FEED_CHUNK_SIZE
));