diff options
| author | Mario Vavti <mario@mariovavti.com> | 2024-11-03 11:45:08 +0100 |
|---|---|---|
| committer | Mario Vavti <mario@mariovavti.com> | 2024-11-03 11:45:08 +0100 |
| commit | d25314c75b0941b91f73eb39cba489ec6b48c301 (patch) | |
| tree | 7cdb40cf9e1d17c22a363f8baaaf03a099281c58 /Zotlabs/Module/Admin/Account_edit.php | |
| parent | 005d4ad35143e417b7c1dbfbf38417dee03e9608 (diff) | |
| parent | e20327d26760adbea6554268119bc671e0199afb (diff) | |
| download | volse-hubzilla-d25314c75b0941b91f73eb39cba489ec6b48c301.tar.gz volse-hubzilla-d25314c75b0941b91f73eb39cba489ec6b48c301.tar.bz2 volse-hubzilla-d25314c75b0941b91f73eb39cba489ec6b48c301.zip | |
Merge branch 'dev' into containers
Diffstat (limited to 'Zotlabs/Module/Admin/Account_edit.php')
| -rw-r--r-- | Zotlabs/Module/Admin/Account_edit.php | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/Zotlabs/Module/Admin/Account_edit.php b/Zotlabs/Module/Admin/Account_edit.php index 0300fb10c..35a15133f 100644 --- a/Zotlabs/Module/Admin/Account_edit.php +++ b/Zotlabs/Module/Admin/Account_edit.php @@ -8,6 +8,11 @@ class Account_edit { function post() { + // Validate CSRF token + // + // We terminate with a 403 Forbidden status if the check fails. + check_form_security_token_ForbiddenOnErr('admin_account_edit', 'security'); + $account_id = $_REQUEST['aid']; if(! $account_id) @@ -18,7 +23,7 @@ class Account_edit { if($pass1 && $pass2 && ($pass1 === $pass2)) { $salt = random_string(32); $password_encoded = hash('whirlpool', $salt . $pass1); - $r = q("update account set account_salt = '%s', account_password = '%s', + $r = q("update account set account_salt = '%s', account_password = '%s', account_password_changed = '%s' where account_id = %d", dbesc($salt), dbesc($password_encoded), @@ -34,7 +39,7 @@ class Account_edit { $account_level = 5; $account_language = trim($_REQUEST['account_language']); - $r = q("update account set account_service_class = '%s', account_level = %d, account_language = '%s' + $r = q("update account set account_service_class = '%s', account_level = %d, account_language = '%s' where account_id = %d", dbesc($service_class), intval($account_level), @@ -62,8 +67,8 @@ class Account_edit { return ''; } - $a = replace_macros(get_markup_template('admin_account_edit.tpl'), [ + '$security' => get_form_security_token('admin_account_edit'), '$account' => $x[0], '$title' => t('Account Edit'), '$pass1' => [ 'pass1', t('New Password'), ' ','' ], |