fix possible xsrf in entry manager

diff --git a/docs/NEWS b/docs/NEWS
index 49bba2c4faa0dd4c7d0b076e9f97020bd1e3a4a2..d44d5df05f8567d2c8dc34bd102d82e7e03d8bf9 100644 (file)
--- a/docs/NEWS
+++ b/docs/NEWS
@@ -3,6 +3,9 @@
 Version 1.0 ()
 ------------------------------------------------------------------------
 
+   * Fix another (minor) XSRF for entry manager, thanks to Geoff Johnson
+     (garvinhicking)
+
    * Support "Force Feedburner" option to the syndication plugin to
      let rss.php only be accessible to feedburner and no clients.
      (garvinhicking)

diff --git a/include/admin/entries.inc.php b/include/admin/entries.inc.php
index c7fe843e373e82472dc9e439b83d959accbdb0ec..1430a4f682af7b8f34b733e07274ab55eb5ed6ee 100644 (file)
--- a/include/admin/entries.inc.php
+++ b/include/admin/entries.inc.php
@@ -255,7 +255,7 @@ function serendipity_drawList() {
                         </td>
                         <td align="right">
                             <a href="?serendipity[action]=admin&amp;serendipity[adminModule]=entries&amp;serendipity[adminAction]=edit&amp;serendipity[id]=<?php echo $entry['id']; ?>" title="<?php echo EDIT . ' #' . $entry['id']; ?>" class="serendipityIconLink"><img src="<?php echo serendipity_getTemplateFile('admin/img/edit.png'); ?>" alt="<?php echo EDIT; ?>" /><?php echo EDIT ?></a>
-                            <a href="?serendipity[action]=admin&amp;serendipity[adminModule]=entries&amp;serendipity[adminAction]=delete&amp;serendipity[id]=<?php echo $entry['id']; ?>" title="<?php echo DELETE . ' #' . $entry['id']; ?>" class="serendipityIconLink"><img src="<?php echo serendipity_getTemplateFile('admin/img/delete.png'); ?>" alt="<?php echo DELETE; ?>" /><?php echo DELETE ?></a>
+                            <a href="?<?php echo serendipity_setFormToken('url'); ?>&amp;serendipity[action]=admin&amp;serendipity[adminModule]=entries&amp;serendipity[adminAction]=delete&amp;serendipity[id]=<?php echo $entry['id']; ?>" title="<?php echo DELETE . ' #' . $entry['id']; ?>" class="serendipityIconLink"><img src="<?php echo serendipity_getTemplateFile('admin/img/delete.png'); ?>" alt="<?php echo DELETE; ?>" /><?php echo DELETE ?></a>
                         </td>
                     </tr>
                 </table>
@@ -437,8 +437,11 @@ switch($serendipity['GET']['adminAction']) {
         break;
 
     case 'doDelete':
-        serendipity_deleteEntry($serendipity['GET']['id']);
-        printf(RIP_ENTRY, $serendipity['GET']['id']);
+        if (!serendipity_checkFormToken()) {
+            break;
+        }
+        serendipity_deleteEntry((int)$serendipity['GET']['id']);
+        printf(RIP_ENTRY, (int)$serendipity['GET']['id']);
         echo '<br />';
 
     case 'editSelect':
@@ -446,13 +449,16 @@ switch($serendipity['GET']['adminAction']) {
         break;
 
     case 'delete':
-        $newLoc = '?serendipity[action]=admin&amp;serendipity[adminModule]=entries&amp;serendipity[adminAction]=doDelete&amp;serendipity[id]=' . $serendipity['GET']['id'];
-        printf(DELETE_SURE, $serendipity['GET']['id']);
+        if (!serendipity_checkFormToken()) {
+            break;
+        }
+        $newLoc = '?' . serendipity_setFormToken('url') . '&amp;serendipity[action]=admin&amp;serendipity[adminModule]=entries&amp;serendipity[adminAction]=doDelete&amp;serendipity[id]=' . (int)$serendipity['GET']['id'];
+        printf(DELETE_SURE, (int)$serendipity['GET']['id']);
 ?>
 <br />
 <br />
 <div>
-    <a href="<?php echo $_SERVER["HTTP_REFERER"]; ?>" class="serendipityPrettyButton"><?php echo NOT_REALLY; ?></a>
+    <a href="<?php echo htmlspecialchars($_SERVER["HTTP_REFERER"]); ?>" class="serendipityPrettyButton"><?php echo NOT_REALLY; ?></a>
     <?php echo str_repeat('&nbsp;', 10); ?>
     <a href="<?php echo $newLoc; ?>" class="serendipityPrettyButton"><?php echo DUMP_IT; ?></a>
 </div>