Changeset 860:e6db669b069f for admin/user.php

Timestamp:

08/02/12 23:08:21 (13 years ago)

Author:

JcDenis

Branch:

default

Children:

861:3e2e678fef61, 1022:6c73aaf901f8

Message:

Fixes a CSRF on users deletion.
Cleaned code on users manager, fixes #1200

File:

• admin/user.php (modified) (3 diffs)

admin/user.php

@@ -290 +290 @@
 if ($user_id)
 {
-     echo '<div class="clear fieldset"><h3>'.__('Permissions').'</h3>';
+     echo '<div class="clear fieldset"><h3>'.__('Permissions').'</h3>'.
+     '<form action="users_actions.php" method="post">'.
+     '<p><input type="submit" value="'.__('Add new permissions').'" />'.
+     form::hidden(array('redir'),'user.php?id='.$user_id).
+     form::hidden(array('action'),'blogs').
+     form::hidden(array('users[]'),$user_id).
+     $core->formNonce().
+     '</p>'.
+     '</form>';
      
      $permissions = $core->getUserPermissions($user_id);
@@ -305 +313 @@
                if (count($v['p']) > 0)
                {
-                    echo '<h4><a href="blog.php?id='.html::escapeHTML($k).'">'.
-                    html::escapeHTML($v['name']).'</a> ('.html::escapeHTML($k).') - '.
-                    '<a href="permissions.php?blog_id[]='.$k.'&amp;user_id[]='.$user_id.'">'
-                    .__('Change permissions').'</a></h4>';
+                    echo 
+                    '<form action="users_actions.php" method="post">'.
+                    '<h4><a href="blog.php?id='.html::escapeHTML($k).'">'.
+                    html::escapeHTML($v['name']).'</a> ('.html::escapeHTML($k).')</h4>';
                     
                     echo '<ul>';
@@ -316 +324 @@
                          }
                     }
-                    echo '</ul>';
+                    echo '</ul>'.
+                    '<p><input type="submit" value="'.__('Change permissions').'" />'.
+                    form::hidden(array('redir'),'user.php?id='.$user_id).
+                    form::hidden(array('action'),'perms').
+                    form::hidden(array('users[]'),$user_id).
+                    form::hidden(array('blogs[]'),$k).
+                    $core->formNonce().
+                    '</p>'.
+                    '</form>';
                }
           }
      }
      
-     echo
-     '<p><a href="permissions_blog.php?user_id[]='.$user_id.'">'.
-     __('Add new permissions').'</a></p>'.
-     '</div>';
+     echo '</div>';
 }