Files
Facilitor/APPL/FAC/fac_user_messages_setReadFlag.asp
Erik Groener 6c20f7627c FSN#37517 PENTEST PINE 4.7.1: CSRF token vaker gebruiken
svn path=/Website/trunk/; revision=30481
2016-08-31 14:14:56 +00:00

58 lines
1.4 KiB
Plaintext

<%@language="javascript"%>
<%
/*
$Revision$
$Id$
*/
var deleteall = getFParamInt("deleteall", 0) == 1;
var JSON_Result = true;
%>
<!-- #include file="../Shared/common.inc" -->
<!-- #include file="../Shared/json2.js" -->
<%
if (deleteall)
{
sql = "DELETE FROM web_user_messages"
+ " WHERE prs_perslid_key_receiver = "+ user_key; /* forces authorization */
Oracle.Execute(sql);
var result = { success: true };
Response.Write(JSON.stringify(result));
}
else
{
var messKey = getQParamInt("messKey");
var purge = getQParamInt("purge", 0) == 1;
var act = getQParam("act", "");
var messKey = getFParamInt("messkey");
protectRequest.validateToken();
if (messKey)
{
var sql = "";
if (purge)
{
sql = "DELETE FROM web_user_messages"
+ " WHERE web_user_message_key = " + messKey
+ " AND prs_perslid_key_receiver = "+ user_key; /* forces authorization */
}
else
{
sql = "UPDATE web_user_messages SET web_user_mess_action_status = '2' "
+ " WHERE web_user_message_key = " + messKey
+ " AND prs_perslid_key_receiver = "+ user_key; /* forces authorization */
}
Oracle.Execute(sql);
}
if (act != "") {
Response.Redirect(act);
}
var result = { success: true };
Response.Write(JSON.stringify(result));
}
%>