diff --git a/functions/functions.php b/functions/functions.php index 602a54e..3e33238 100644 --- a/functions/functions.php +++ b/functions/functions.php @@ -333,39 +333,3 @@ function identical_values(array $arrayA, array $arrayB):bool { } -/** - * Function for retrieving the anti-csrf token or generating it if need be. - * - * @return string - */ -function getAntiCsrfToken():string { - - if (empty($_SESSION['csrf-token'])) { - $_SESSION['csrf-token'] = bin2hex(random_bytes(32)); - } - - return $_SESSION['csrf-token']; - -} - -/** - * Function for validating anti-csrf tokens. Each anti-csrf token is removed - * after use. - * - * @return boolean - */ -function validateAntiCsrfToken():bool { - - $validity = false; - if (!empty($_POST['csrf-token']) - && !empty($_SESSION['csrf-token']) - && hash_equals($_SESSION['csrf-token'], $_POST['csrf-token']) === true - ) { - $validity = true; - } - $_SESSION['csrf-token'] = null; unset($_SESSION['csrf-token']); - - return $validity; - -} - diff --git a/public/index.php b/public/index.php index dc6cbba..b6c7c72 100644 --- a/public/index.php +++ b/public/index.php @@ -38,7 +38,7 @@ echo '
- + diff --git a/public/index3.php b/public/index3.php index b75f89b..99ddd4f 100644 --- a/public/index3.php +++ b/public/index3.php @@ -381,6 +381,7 @@ echo '
'; if ($error + $depcon_error > 0) { echo '

Error(s) found: ' . ($error + $depcon_error) . '

'; + echo 'Create XML for md:import (utf8)
'; } else { echo 'Create XML for md:import (utf8)
'; diff --git a/public/upload.php b/public/upload.php index 2a8c88e..a9148aa 100644 --- a/public/upload.php +++ b/public/upload.php @@ -15,7 +15,7 @@ if (session_status() != PHP_SESSION_ACTIVE) { session_start(); } -if (validateAntiCsrfToken() === false) { +if (MD_STD_SEC::validateAntiCsrfToken() === false) { throw new MDWrongCsrfTokenException(); }