clemens/kaffeekasse-saas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CSRF - erste Erichtigung

Browse Source
This commit is contained in:
clemens
2026-07-12 08:55:56 +02:00
parent 174fff6f31
commit 444f0a269b
6 changed files with 75 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hinweise.php
+31 -22
View File
@@ -1,6 +1,7 @@
<?php
include "functions.php";
app_require_csrf();
include "header.php";
include "headerline.php";
include "nav.php";
@@ -20,33 +21,34 @@ if(checkKaffeelisteAdmin($conn, $mailadress)){
echo "<h2>Kaffeeliste - Hinweise</h2>";
// Hinweis löschen
if (isset($_GET['delete'])) {
$id = (int)$_GET['delete'];
$stmt = sqlsrv_query($conn, "DELETE FROM kl_hinweise WHERE id = ?", [$id]);
}
// Hinweis speichern
// Hinweis speichern oder löschen
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
$nachricht = $_POST['nachricht'];
$gueltig_bis = $_POST['gueltig_bis']; // z.B. "2025-09-03T14:00"
$dt = DateTime::createFromFormat('Y-m-d\TH:i', $gueltig_bis);
$aktion = $_POST['aktion'] ?? 'speichern';
if ($dt) {
$gueltig_bis_sql = $dt->format('Y-m-d H:i:s'); // z.B. "2025-09-03 14:00:00"
if ($aktion === 'loeschen') {
$id = (int)($_POST['id'] ?? 0);
if ($id > 0) {
$stmt = sqlsrv_query($conn, "DELETE FROM kl_hinweise WHERE id = ?", [$id]);
}
} else {
die("Ungültiges Datumsformat");
}
$nachricht = $_POST['nachricht'];
$gueltig_bis = $_POST['gueltig_bis']; // z.B. "2025-09-03T14:00"
$dt = DateTime::createFromFormat('Y-m-d\TH:i', $gueltig_bis);
if (!empty($nachricht) && !empty($gueltig_bis_sql)) {
if ($dt) {
$gueltig_bis_sql = $dt->format('Y-m-d H:i:s'); // z.B. "2025-09-03 14:00:00"
} else {
die("Ungültiges Datumsformat");
}
if (!empty($nachricht) && !empty($gueltig_bis_sql)) {
$stmt = sqlsrv_query($conn,
"INSERT INTO kl_hinweise (nachricht, gueltig_bis) VALUES (?, ?)",
[$nachricht, $gueltig_bis_sql]
);
$stmt = sqlsrv_query($conn,
"INSERT INTO kl_hinweise (nachricht, gueltig_bis) VALUES (?, ?)",
[$nachricht, $gueltig_bis_sql]
);
}
}
}
@@ -61,6 +63,8 @@ if(checkKaffeelisteAdmin($conn, $mailadress)){
<h2>Neuen Hinweis hinzufügen</h2>
<form method="post">
<input type="hidden" name="aktion" value="speichern">
<?php echo app_csrf_field(); ?>
<label>Nachricht:</label><br>
<textarea name="nachricht" required></textarea><br><br>
<label>Gültig bis:</label><br>
@@ -73,7 +77,12 @@ if(checkKaffeelisteAdmin($conn, $mailadress)){
<div class="hinweis">
<strong><?= htmlspecialchars($hinweis['nachricht']) ?></strong><br>
<small>Gültig bis: <?= $hinweis['gueltig_bis']->format('d.m.Y H:i') ?></small><br>
<a href="?delete=<?= $hinweis['id'] ?>" onclick="return confirm('Diesen Hinweis wirklich löschen?')">🗑️ Löschen</a>
<form method="post" action="<?php echo htmlspecialchars($_SERVER["PHP_SELF"]); ?>" onsubmit="return confirm('Diesen Hinweis wirklich löschen?')">
<input type="hidden" name="aktion" value="loeschen">
<input type="hidden" name="id" value="<?= (int)$hinweis['id'] ?>">
<?php echo app_csrf_field(); ?>
<button type="submit">Löschen</button>
</form>
</div>
<?php endforeach; ?>
</body>