diff --git a/contrib/admin/main.php b/contrib/admin/main.php index 87d7461b..5a34a376 100644 --- a/contrib/admin/main.php +++ b/contrib/admin/main.php @@ -52,7 +52,7 @@ class AdminPage implements Extension { } if(($event instanceof PageRequestEvent) && $event->page_matches("admin_utils")) { - if($user->is_admin()) { + if($user->is_admin() && $user->check_auth_token()) { log_info("admin", "Util: {$_POST['action']}"); set_time_limit(0); $redirect = false; diff --git a/contrib/admin/theme.php b/contrib/admin/theme.php index f732c45b..dce3b26d 100644 --- a/contrib/admin/theme.php +++ b/contrib/admin/theme.php @@ -17,8 +17,11 @@ class AdminPageTheme extends Themelet { * 'purge unused tags' */ public function display_form(Page $page) { + global $user; + $html = "

+ ".$user->get_auth_html()." @@ -72,6 +75,7 @@ class BlotterTheme extends Themelet { $entry_text $important + ".$user->get_auth_html()."
diff --git a/contrib/bulk_add/main.php b/contrib/bulk_add/main.php index 5d9ad998..0fa89029 100644 --- a/contrib/bulk_add/main.php +++ b/contrib/bulk_add/main.php @@ -18,9 +18,8 @@ class BulkAdd extends SimpleExtension { public function onPageRequest($event) { global $page, $user; if($event->page_matches("bulk_add")) { - if($user->is_admin() && isset($_POST['dir'])) { + if($user->is_admin() && $user->check_auth_token() && isset($_POST['dir'])) { set_time_limit(0); - $this->add_dir($_POST['dir']); $this->theme->display_upload_results($page); } @@ -28,8 +27,7 @@ class BulkAdd extends SimpleExtension { } public function onAdminBuilding($event) { - global $page; - $this->theme->display_admin_block($page); + $this->theme->display_admin_block(); } diff --git a/contrib/bulk_add/theme.php b/contrib/bulk_add/theme.php index a0403aa1..973a2504 100644 --- a/contrib/bulk_add/theme.php +++ b/contrib/bulk_add/theme.php @@ -20,7 +20,8 @@ class BulkAddTheme extends Themelet { * links to bulk_add with POST[dir] set to the name of a server-side * directory full of images */ - public function display_admin_block(Page $page) { + public function display_admin_block() { + global $page, $user; $html = " Add a folder full of images; any subfolders will have their names used as tags for the images within. @@ -28,6 +29,7 @@ class BulkAddTheme extends Themelet { upload via FTP or something first.

+ ".$user->get_auth_html()." Directory to add:
diff --git a/contrib/favorites/main.php b/contrib/favorites/main.php index 16331d30..4a8f5351 100644 --- a/contrib/favorites/main.php +++ b/contrib/favorites/main.php @@ -57,7 +57,7 @@ class Favorites extends SimpleExtension { public function onPageRequest($event) { global $page, $user; - if($event->page_matches("change_favorite") && !$user->is_anonymous()) { + if($event->page_matches("change_favorite") && !$user->is_anonymous() && $user->check_auth_token()) { $image_id = int_escape($_POST['image_id']); if((($_POST['favorite_action'] == "set") || ($_POST['favorite_action'] == "unset")) && ($image_id > 0)) { send_event(new FavoriteSetEvent($image_id, $user, ($_POST['favorite_action'] == "set"))); diff --git a/contrib/favorites/theme.php b/contrib/favorites/theme.php index 6a45876e..9c6449da 100644 --- a/contrib/favorites/theme.php +++ b/contrib/favorites/theme.php @@ -5,22 +5,15 @@ class FavoritesTheme extends Themelet { global $page, $user; $i_image_id = int_escape($image->id); - if(!$is_favorited) { - $html = "
- - - -
- "; - } - else { - $html = "
- - - -
- "; - } + $name = $is_favorited ? "unset" : "set"; + $label = $is_favorited ? "Un-Favorite" : "Favorite"; + $html = "
+ ".$user->get_auth_html()." + + + +
+ "; return $html; } diff --git a/contrib/featured/main.php b/contrib/featured/main.php index eebc16b5..7f47754a 100644 --- a/contrib/featured/main.php +++ b/contrib/featured/main.php @@ -27,7 +27,7 @@ class Featured extends SimpleExtension { public function onPageRequest($event) { global $config, $page, $user; if($event->page_matches("featured_image")) { - if($event->get_arg(0) == "set") { + if($event->get_arg(0) == "set" && $user->check_auth_token()) { if($user->is_admin() && isset($_POST['image_id'])) { $id = int_escape($_POST['image_id']); if($id > 0) { diff --git a/contrib/featured/theme.php b/contrib/featured/theme.php index ff2fb9ae..8d93b042 100644 --- a/contrib/featured/theme.php +++ b/contrib/featured/theme.php @@ -9,8 +9,10 @@ class FeaturedTheme extends Themelet { } public function get_buttons_html($image_id) { + global $user; return "
+ ".$user->get_auth_html()."
diff --git a/contrib/ipban/main.php b/contrib/ipban/main.php index 1da85406..679678d4 100644 --- a/contrib/ipban/main.php +++ b/contrib/ipban/main.php @@ -51,7 +51,7 @@ class IPBan implements Extension { if(($event instanceof PageRequestEvent) && $event->page_matches("ip_ban")) { if($user->is_admin()) { - if($event->get_arg(0) == "add") { + if($event->get_arg(0) == "add" && $user->check_auth_token()) { if(isset($_POST['ip']) && isset($_POST['reason']) && isset($_POST['end'])) { if(empty($_POST['end'])) $end = null; else $end = $_POST['end']; @@ -61,7 +61,7 @@ class IPBan implements Extension { $page->set_redirect(make_link("ip_ban/list")); } } - else if($event->get_arg(0) == "remove") { + else if($event->get_arg(0) == "remove" && $user->check_auth_token()) { if(isset($_POST['id'])) { send_event(new RemoveIPBanEvent($_POST['id'])); $page->set_mode("redirect"); diff --git a/contrib/ipban/theme.php b/contrib/ipban/theme.php index 67007b89..b4d02479 100644 --- a/contrib/ipban/theme.php +++ b/contrib/ipban/theme.php @@ -28,6 +28,7 @@ class IPBanTheme extends Themelet { {$end_human}
+ ".$user->get_auth_html()."
@@ -47,6 +48,7 @@ class IPBanTheme extends Themelet { $h_bans
+ ".$user->get_auth_html()." {$user->name} diff --git a/contrib/numeric_score/main.php b/contrib/numeric_score/main.php index 8f4cfc3d..982b42f0 100644 --- a/contrib/numeric_score/main.php +++ b/contrib/numeric_score/main.php @@ -39,7 +39,7 @@ class NumericScore implements Extension { } } - if(($event instanceof PageRequestEvent) && $event->page_matches("numeric_score_vote")) { + if(($event instanceof PageRequestEvent) && $event->page_matches("numeric_score_vote") && $user->check_auth_token()) { if(!$user->is_anonymous()) { $image_id = int_escape($_POST['image_id']); $char = $_POST['vote']; diff --git a/contrib/numeric_score/theme.php b/contrib/numeric_score/theme.php index 48ffb98e..94f0f4c6 100644 --- a/contrib/numeric_score/theme.php +++ b/contrib/numeric_score/theme.php @@ -2,6 +2,7 @@ class NumericScoreTheme extends Themelet { public function get_voter_html(Image $image) { + global $user; $i_image_id = int_escape($image->id); $i_score = int_escape($image->numeric_score); @@ -9,18 +10,21 @@ class NumericScoreTheme extends Themelet { Current Score: $i_score

+ ".$user->get_auth_html()."

+ ".$user->get_auth_html()."
+ ".$user->get_auth_html()." diff --git a/contrib/pm/main.php b/contrib/pm/main.php index 9aef8ef3..f8599057 100644 --- a/contrib/pm/main.php +++ b/contrib/pm/main.php @@ -107,29 +107,30 @@ class PrivMsg extends SimpleExtension { } break; case "delete": - $pm_id = int_escape($event->get_arg(1)); - $pm = $database->get_row("SELECT * FROM private_message WHERE id = ?", array($pm_id)); - if(is_null($pm)) { - $this->theme->display_error($page, "No such PM", "There is no PM #$pm_id"); - } - else if(($pm["to_id"] == $user->id) || $user->is_admin()) { - $database->execute("DELETE FROM private_message WHERE id = ?", array($pm_id)); - log_info("pm", "Deleted PM #$pm_id"); - $page->set_mode("redirect"); - $page->set_redirect($_SERVER["HTTP_REFERER"]); - } - else { - // permission denied + if($user->check_auth_token()) { + $pm_id = int_escape($_POST["pm_id"]); + $pm = $database->get_row("SELECT * FROM private_message WHERE id = ?", array($pm_id)); + if(is_null($pm)) { + $this->theme->display_error($page, "No such PM", "There is no PM #$pm_id"); + } + else if(($pm["to_id"] == $user->id) || $user->is_admin()) { + $database->execute("DELETE FROM private_message WHERE id = ?", array($pm_id)); + log_info("pm", "Deleted PM #$pm_id"); + $page->set_mode("redirect"); + $page->set_redirect($_SERVER["HTTP_REFERER"]); + } } break; case "send": - $to_id = int_escape($_POST["to_id"]); - $from_id = $user->id; - $subject = $_POST["subject"]; - $message = $_POST["message"]; - send_event(new SendPMEvent(new PM($from_id, $_SERVER["REMOTE_ADDR"], $to_id, $subject, $message))); - $page->set_mode("redirect"); - $page->set_redirect($_SERVER["HTTP_REFERER"]); + if($user->check_auth_token()) { + $to_id = int_escape($_POST["to_id"]); + $from_id = $user->id; + $subject = $_POST["subject"]; + $message = $_POST["message"]; + send_event(new SendPMEvent(new PM($from_id, $_SERVER["REMOTE_ADDR"], $to_id, $subject, $message))); + $page->set_mode("redirect"); + $page->set_redirect($_SERVER["HTTP_REFERER"]); + } break; default: $this->theme->display_error($page, "Invalid action", "That's not something you can do with a PM"); diff --git a/contrib/pm/theme.php b/contrib/pm/theme.php index bfb454a0..f20eee1a 100644 --- a/contrib/pm/theme.php +++ b/contrib/pm/theme.php @@ -2,6 +2,8 @@ class PrivMsgTheme extends Themelet { public function display_pms(Page $page, $pms) { + global $user; + $html = " + ".$user->get_auth_html()." $rows
NameValue