NiekRabelink/Fociz
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implement CSRF protection for user invitation and management actions; add QR code generation script; secure internal includes directory with .htaccess

Browse Source
This commit is contained in:
Niek Rabelink
2026-09-11 14:46:08 +02:00
parent 55618ffaed
commit cf0ceeca82
18 changed files with 413 additions and 163 deletions
Download Patch File Download Diff File Expand all files Collapse all files
admin.php
+16 -3
View File
@@ -27,7 +27,11 @@ if (!empty($_GET['success'])) {
// POST Verwerking VÓÓR header output zodat redirects en opslaan vlekkeloos werken
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$action = $_POST['action'] ?? '';
if (!verify_csrf_token($_POST['csrf_token'] ?? null)) {
$message = "Beveiligingsfout: CSRF-token ongeldig of verlopen. Ververs de pagina en probeer opnieuw.";
$messageType = 'error';
} else {
$action = $_POST['action'] ?? '';
// 1. Centrale Azure App Registratie opslaan
if ($action === 'save_azure') {
@@ -194,7 +198,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$currentAi = get_ai_settings();
if ($apiKeyIn !== '' && $apiKeyIn !== '••••••••••••••••') {
set_system_setting('ai_api_key', $apiKeyIn);
set_system_setting('ai_api_key', fociz_encrypt($apiKeyIn));
}
set_system_setting('ai_enabled', $aiEnabled);
@@ -223,6 +227,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
}
}
}
}
}
// Haal actuele configuratie op
@@ -425,6 +430,7 @@ require_once __DIR__ . '/includes/header.php';
<form method="POST" class="mt-6 space-y-5">
<input type="hidden" name="action" value="save_azure">
<input type="hidden" name="csrf_token" value="<?= htmlspecialchars(get_csrf_token()) ?>">
<!-- Redirect URI Kopieerbox -->
<div class="p-4 rounded-2xl bg-slate-50 dark:bg-[#0c0f17] border border-slate-200 dark:border-slate-800 space-y-2">
@@ -563,6 +569,7 @@ require_once __DIR__ . '/includes/header.php';
<form method="POST" class="mt-6 space-y-4">
<input type="hidden" name="action" value="save_jira_domain">
<input type="hidden" name="csrf_token" value="<?= htmlspecialchars(get_csrf_token()) ?>">
<div>
<label class="block text-xs font-semibold text-slate-700 dark:text-slate-300 mb-1.5">
@@ -697,8 +704,9 @@ require_once __DIR__ . '/includes/header.php';
<form method="POST" action="/admin.php" onsubmit="return confirm('Weet u zeker dat u het filter \'<?= htmlspecialchars(addslashes($filter['filter_name'])) ?>\' wilt verwijderen?');" class="inline">
<input type="hidden" name="action" value="delete_jira_queue_filter">
<input type="hidden" name="filter_id" value="<?= (int)$filter['id'] ?>">
<input type="hidden" name="csrf_token" value="<?= htmlspecialchars(get_csrf_token()) ?>">
<button type="submit" class="p-2 rounded-xl text-rose-600 hover:bg-rose-50 dark:hover:bg-rose-950/40 transition cursor-pointer" title="Verwijderen">
<i data-lucide="trash-2" class="w-4 h-4"></i>
<i data-lucide="trash-2" class="w-4 h-4 inline"></i>
</button>
</form>
</div>
@@ -724,6 +732,7 @@ require_once __DIR__ . '/includes/header.php';
<form method="POST" action="/admin.php" class="space-y-4">
<input type="hidden" name="action" value="save_user_jira_assignments">
<input type="hidden" name="csrf_token" value="<?= htmlspecialchars(get_csrf_token()) ?>">
<div class="overflow-x-auto rounded-2xl border border-slate-200 dark:border-slate-800">
<table class="w-full text-left text-xs">
@@ -805,6 +814,7 @@ require_once __DIR__ . '/includes/header.php';
<form method="POST" action="/admin.php" class="mt-4 space-y-4">
<input type="hidden" name="action" value="save_jira_queue_filter">
<input type="hidden" name="csrf_token" value="<?= htmlspecialchars(get_csrf_token()) ?>">
<input type="hidden" id="filterModal_id" name="filter_id" value="0">
<div class="grid grid-cols-1 sm:grid-cols-2 gap-3">
@@ -881,6 +891,7 @@ require_once __DIR__ . '/includes/header.php';
<form method="POST" action="/admin.php" class="space-y-4">
<input type="hidden" name="action" value="save_workday_settings">
<input type="hidden" name="csrf_token" value="<?= htmlspecialchars(get_csrf_token()) ?>">
<div class="grid grid-cols-1 sm:grid-cols-2 gap-4">
<!-- Werkdag uren -->
@@ -993,6 +1004,7 @@ require_once __DIR__ . '/includes/header.php';
<form method="POST" action="/admin.php" class="space-y-4">
<input type="hidden" name="action" value="save_ai_settings">
<input type="hidden" name="csrf_token" value="<?= htmlspecialchars(get_csrf_token()) ?>">
<div class="p-3.5 rounded-2xl bg-amber-50/70 dark:bg-amber-950/20 border border-amber-200/70 dark:border-amber-800/40">
<label class="flex items-center space-x-2 text-xs text-amber-900 dark:text-amber-200 cursor-pointer select-none">
@@ -1080,6 +1092,7 @@ require_once __DIR__ . '/includes/header.php';
<form method="POST" action="/admin.php" class="flex flex-col sm:flex-row gap-2.5">
<input type="hidden" name="action" value="send_test_email">
<input type="hidden" name="csrf_token" value="<?= htmlspecialchars(get_csrf_token()) ?>">
<div class="relative flex-1">
<input
type="email"