Cavemanon/cavepaintings
7
Fork 2
Code Issues 3 Pull Requests Projects Releases Wiki Activity

Separate out GET and POST more explicitly

Browse Source 
- No longer allow uploading directly via GET, that is terrible for
  security. Instead, use the GET parameters to pre-fill the upload form.
- PageRequestEvent has a `method` property that can be checked in
  extensions
This commit is contained in:
Shish
2024-01-01 02:32:13 +00:00
committed by Shish
parent 5356008985
commit 26bf4277e0
11 changed files with 109 additions and 119 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
ext/admin/main.php
View File

@ -86,16 +86,15 @@ class AdminPage extends Extension
parse_str($event->args[1], $_GET);
$_SERVER['REQUEST_URI'] .= "?" . $event->args[1];
}
send_event(new PageRequestEvent($event->args[0]));
send_event(new PageRequestEvent("GET", $event->args[0]));
$page->display();
}
if ($event->cmd == "post-page") {
global $page;
$_SERVER['REQUEST_METHOD'] = "POST";
if (isset($event->args[1])) {
parse_str($event->args[1], $_POST);
}
send_event(new PageRequestEvent($event->args[0]));
send_event(new PageRequestEvent("POST", $event->args[0]));
$page->display();
}
if ($event->cmd == "get-token") {