admin/Facilitor
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

FSN#22720 FOX#24 Cross Site Request Forgery voorkomen

Browse Source 
svn path=/Website/trunk/; revision=17145
This commit is contained in:
Erik Groener
2013-03-12 10:51:22 +00:00
parent 4492f37bf6
commit ea17af9bd7
13 changed files with 72 additions and 43 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
APPL/MLD/mld_edit_uitvoeren.asp
View File

@@ -115,13 +115,17 @@ var opdrnr = oRs("opdrnr").value;
document.activeElement.blur(); // trigger laatste onChanges
if (!validateForm("u2"))
return false;
var data = { mld_uitvoeren_key: <%=mld_uitvoeren_key%>,
mld_opdr_key: <%=mld_opdr_key%>,
mlduitvoerendag: $("#mlduitvoerendag").val(),
uitvoeren_van: $("#uitvoeren_van").val(),
uitvoeren_tot: $("#uitvoeren_tot").val(),
mld_uitvoeren_infrequent: $("#mld_uitvoeren_infrequent")[0].checked? 1 : 0
};
<% protectRequest.dataToken("data"); %>
$.post("mld_edit_uitvoeren_save.asp",
{ mld_uitvoeren_key: <%=mld_uitvoeren_key%>,
mld_opdr_key: <%=mld_opdr_key%>,
mlduitvoerendag: $("#mlduitvoerendag").val(),
uitvoeren_van: $("#uitvoeren_van").val(),
uitvoeren_tot: $("#uitvoeren_tot").val(),
mld_uitvoeren_infrequent: $("#mld_uitvoeren_infrequent")[0].checked? 1 : 0 },
data,
submitCallback,
"json");
}

5
APPL/MLD/mld_opdr.asp
View File

@@ -127,8 +127,11 @@ var copyconfirm = getQParamInt("copyconfirm", 0) == 1;
{
if (confirm(L("lcl_mld_ord_bymail")))
{
var data = { opdr_key: params.opdr_key
};
<% protectRequest.dataToken("data"); %>
$.post("order_mail.asp",
{ opdr_key: params.opdr_key },
data,
opdrMailCallback,
"json");
}

1
APPL/MLD/mld_uitvoeren_delete.asp
View File

@@ -14,6 +14,7 @@ DOCTYPE_Disable = 1;
<!-- #include file="mld.inc" -->
<%
protectRequest.validateToken();
/***** Get webform parameters *****/
var mld_uitvoeren_key_arr = getFParamIntArray("mld_uitvoeren_key");
var message = "";

7
APPL/MLD/mld_uitvoeren_list.asp
View File

@@ -51,10 +51,15 @@ var canAdd = this_opdr.canChange;
{
var mldData = eval('(' + row.getAttribute("ROWDATA") + ')');
if (confirm(L("lcl_mld_del_txt_uitvoeren")))
{
var data = { mld_uitvoeren_key: mldData.key
};
<% protectRequest.dataToken("data"); %>
$.post("mld_uitvoeren_delete.asp",
{ mld_uitvoeren_key: mldData.key },
data,
FcltCallbackRefresh,
"json");
}
}
</script>
</head>

1
APPL/MLD/opdr_approve.asp
View File

@@ -18,6 +18,7 @@ var JSON_Result = true;
<!-- #include file="mld.inc" -->
<%
protectRequest.validateToken();
/***** Get webform parameters *****/
var opdr_key_arr = getFParamIntArray("opdr_key");

68
APPL/MLD/opdr_edit_uren.asp
View File

@@ -128,20 +128,22 @@ if (urole != "fe" && canWrite)
else
$("#fldmldurentotal", tr).addClass("afwijk");
var data = { prs_key: <%=prs_key%>,
mld_opdr_key: mld_opdr_key,
mld_impropdr_key: mld_impropdr_key,
datum: millisec,
uren: uren
};
<% protectRequest.dataToken("data"); %>
$.post("opdr_edit_uren_save.asp?urole=<%=urole%>",
{ prs_key: <%=prs_key%>,
mld_opdr_key: mld_opdr_key,
mld_impropdr_key: mld_impropdr_key,
datum: millisec,
uren: uren
},
FcltCallbackAndThen(
function (data)
{
if (data.refresh)
window.location.reload(); // bijvoorbeeld als kosten vervallen
}),
"json");
data,
FcltCallbackAndThen(
function (data)
{
if (data.refresh)
window.location.reload(); // bijvoorbeeld als kosten vervallen
}),
"json");
}
// Onchange kostenveldje
@@ -162,13 +164,16 @@ if (urole != "fe" && canWrite)
var kosten = parseInt(veld.value, 10);
}
var kosten_key = parseInt(tr.getAttribute("kosten_key"), 10);
var data = { mld_opdruren_key: veld.getAttribute("ukey"),
kosten_key: kosten_key,
kosten: kosten
};
<% protectRequest.dataToken("data"); %>
$.post("opdr_edit_urenkosten_save.asp?urole=<%=urole%>",
{ mld_opdruren_key: veld.getAttribute("ukey"),
kosten_key: kosten_key,
kosten: kosten
},
FcltCallback,
"json");
data,
FcltCallback,
"json");
}
// klaar met urenbriefje voor deze week
@@ -176,18 +181,19 @@ if (urole != "fe" && canWrite)
{
if (confirm((goedkeuren?"<%=L("lcl_mlduren_approve")%>":"<%=L("lcl_mlduren_close")%>") + "?"))
{
$.post("opdr_edit_uren_save.asp?urole=<%=urole%>",
{ prs_key: <%=prs_key%>,
datum: <%=datefrom.getTime()%>,
done: (goedkeuren?"3":"2")
},
FcltCallbackAndThen(
function (data)
{
FcltMgr.closeDetail(window, {refresh: true});
}
),
"json");
var data = { prs_key: <%=prs_key%>,
datum: <%=datefrom.getTime()%>,
done: (goedkeuren?"3":"2")
};
<% protectRequest.dataToken("data"); %>
$.post("opdr_edit_uren_save.asp?urole=<%=urole%>",
data,
FcltCallbackAndThen(function (data)
{
FcltMgr.closeDetail(window, {refresh: true});
}
),
"json");
}
}
</script>

1
APPL/MLD/opdr_edit_uren_save.asp
View File

@@ -27,6 +27,7 @@ DOCTYPE_Disable = 1;
<!-- #include file="../Shared/json2.js" -->
<%
protectRequest.validateToken();
var urole = getQParamSafe("urole");
var datum_array = getFParamDateArray("datum");
var prs_key_array = getFParamIntArray("prs_key", [user_key]);

3
APPL/MLD/opdr_edit_urenkosten_save.asp
View File

@@ -22,6 +22,7 @@ DOCTYPE_Disable = 1;
<!-- #include file="../Shared/json2.js" -->
<%
protectRequest.validateToken();
var urole = getQParamSafe("urole");
var autfunction = { fe: "WEB_UURUSE", fo: "WEB_UURFOF", bo: "WEB_UURBOF"} [urole];
var authparams = user.checkAutorisation(autfunction);
@@ -48,7 +49,7 @@ var v_actie = "" ; // DB-actie: "" (initieel), "I" (insert), "U" (update), "D" (
if (!oRsk.eof) // er waren al kosten op geboekt
{ v_mld_opdruren_kosten_key = oRsk("mld_opdruren_kosten_key").Value;
if (kosten == 0){
sql = "DELETE FROM mld_opdruren_kosten"
+ " WHERE mld_opdruren_kosten_key = " + v_mld_opdruren_kosten_key;

1
APPL/MLD/opdr_goedkeur.asp
View File

@@ -19,6 +19,7 @@ DOCTYPE_Disable = 1;
<!-- #include file="../prs/prs.inc" -->
<%
protectRequest.validateToken();
var opdr_key = getFParamInt("opdr_key");
var result = { message: "", success: false };

1
APPL/MLD/opdr_reject.asp
View File

@@ -16,6 +16,7 @@
<!-- #include file="mld.inc" -->
<%
protectRequest.validateToken();
FCLTHeader.Requires({ plugins: ["jQuery"] });
//var opdr_key = getQParamInt('opdr_key');
var opdr_key_arr = getQParamIntArray("opdr_key");

1
APPL/MLD/opdr_reject_offer.asp
View File

@@ -19,6 +19,7 @@
<!-- #include file="mld.inc" -->
<%
protectRequest.validateToken();
FCLTHeader.Requires({ plugins: ["jQuery"] });
var opdr_key_arr = getQParamIntArray("opdr_key", []);
if (opdr_key_arr.length == 0)

9
APPL/MLD/opdr_uren_list.inc
View File

@@ -71,10 +71,13 @@ function opdr_uren_list (pautfunction, params)
if (isMulti || confirm(L("lcl_mlduren_approve")))
{
var data = { prs_key: prsKeyString,
datum: datumString,
done: 3
};
<% protectRequest.dataToken("data"); %>
$.post("opdr_edit_uren_save.asp?urole=<%=urole%>&done=3",
{ prs_key: prsKeyString,
datum: datumString,
done: 3 },
data,
FcltCallbackAndThen(function () { parent.doSubmit(); }),
"json");
}

1
APPL/MLD/order_mail.asp
View File

@@ -19,6 +19,7 @@ DOCTYPE_Disable = 1;
<!-- #include file="../Shared/json2.js" -->
<%
protectRequest.validateToken();
var opdr_key = getFParamInt("opdr_key");
// opdracht elektronisch versturen