Dodaj walidację tokenów uploadu oraz zabezpieczenia dostępu w plikach dialog.php i upload-articles-*.php

2025-09-28 10:36:40 +02:00
parent b6712fd486
commit 8d8d3b6174
4 changed files with 246 additions and 170 deletions
--- a/libraries/filemanager-9.14.1/dialog.php
+++ b/libraries/filemanager-9.14.1/dialog.php
@@ -1,4 +1,20 @@
 <?php
+session_start();
+$user = $_SESSION['user'];
+if ( !$user ) {
+  header('HTTP/1.1 403 Forbidden');
+  exit('Access denied');
+}
+
+$akey = $_GET['akey'] ?? $_POST['akey'] ?? '';
+if (
+  empty($_SESSION['rfm_akey']) ||
+  $akey !== $_SESSION['rfm_akey'] ||
+  (($_SESSION['rfm_akey_expires'] ?? 0) < time())
+) {
+  header('HTTP/1.1 403 Forbidden');
+  exit('Invalid key');
+}
 $time = time();

 $config = include 'config/config.php';