smacks/flixcooks-website
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Remove Gemini AI PR review workflow and enhance CSRF protection in admin actions

Browse Source
This commit is contained in:
smacks
2026-07-03 10:46:54 +02:00
parent 4fe45e4e53
commit 1122acd5a5
4 changed files with 18 additions and 359 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin.php
+17 -7
View File
@@ -196,16 +196,23 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'save_
}
if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'delete') {
$slugDel = trim($_POST['slug'] ?? '');
if ($slugDel !== '' && delete_recipe($slugDel)) {
$message = 'Recipe deleted.';
$allRecipes = load_recipes();
if (!hash_equals($_SESSION['csrf_token'] ?? '', $_POST['token'] ?? '')) {
$errors[] = 'Invalid form token, please retry.';
} else {
$message = 'Could not delete recipe.';
$slugDel = trim($_POST['slug'] ?? '');
if ($slugDel !== '' && delete_recipe($slugDel)) {
$message = 'Recipe deleted.';
$allRecipes = load_recipes();
} else {
$message = 'Could not delete recipe.';
}
$editing = null;
$editIndex = null;
}
$editing = null;
$editIndex = null;
} elseif ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'save') {
if (!hash_equals($_SESSION['csrf_token'] ?? '', $_POST['token'] ?? '')) {
$errors[] = 'Invalid form token, please retry.';
} else {
// helpers
$parse_csv = fn($text) => array_values(array_filter(array_map('trim', explode(',', $text ?? '')), 'strlen'));
$parse_lines = fn($text) => array_values(array_filter(array_map('trim', preg_split('/\\r?\\n/', $text ?? '')), 'strlen'));
@@ -344,6 +351,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'delet
$message = 'Could not save to database.';
}
}
} // end CSRF else
}
?>
<!doctype html>
@@ -527,6 +535,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'delet
<a class="button" href="/admin.php?edit=<?php echo urlencode($r['slug']); ?>" style="padding:8px 12px;">Edit</a>
<form method="post" style="margin:0;" onsubmit="return confirm('Delete this recipe?');">
<input type="hidden" name="action" value="delete">
<input type="hidden" name="token" value="<?php echo e($_SESSION['csrf_token']); ?>">
<input type="hidden" name="slug" value="<?php echo e($r['slug']); ?>">
<button type="submit" class="button" style="padding:8px 12px;">Delete</button>
</form>
@@ -538,6 +547,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && ($_POST['action'] ?? '') === 'delet
<form class="admin-form" method="post">
<input type="hidden" name="action" value="save">
<input type="hidden" name="token" value="<?php echo e($_SESSION['csrf_token']); ?>">
<?php if ($editing): ?>
<input type="hidden" name="slug_original" value="<?php echo e($editing['slug']); ?>">
<?php endif; ?>