From ed3e660496213b948b79012487b848d1eedf08d8 Mon Sep 17 00:00:00 2001
From: Moritz Strohm <strohm@data-quest.de>
Date: Wed, 4 Oct 2023 09:52:39 +0000
Subject: use CSRF protection when creating/editing/deleting an OER material,
 fixes #3268

Closes #3268

Merge request studip/studip!2210
---
 app/controllers/oer/mymaterial.php | 2 ++
 app/views/oer/market/details.php   | 1 +
 app/views/oer/mymaterial/edit.php  | 2 +-
 3 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/app/controllers/oer/mymaterial.php b/app/controllers/oer/mymaterial.php
index 5487958..f8e461b 100755
--- a/app/controllers/oer/mymaterial.php
+++ b/app/controllers/oer/mymaterial.php
@@ -29,12 +29,14 @@ class Oer_MymaterialController extends AuthenticatedController
         $content_types = ['application/x-zip-compressed', 'application/zip', 'application/x-zip'];
         $tmp_folder = $GLOBALS['TMP_PATH'] . '/temp_folder_' . md5(uniqid());
         if (Request::submitted('delete') && Request::isPost()) {
+            CSRFProtection::verifyUnsafeRequest();
             $material->pushDataToIndexServers('delete');
             $material->delete();
             PageLayout::postSuccess(_('Das Material wurde gelöscht.'));
             $this->redirect('oer/market/index');
             return;
         } elseif (Request::isPost()) {
+            CSRFProtection::verifyUnsafeRequest();
             $was_new = $material->isNew();
             $material->setData(Request::getArray('data'));
             $material['host_id'] = null;
diff --git a/app/views/oer/market/details.php b/app/views/oer/market/details.php
index 40ebe09..112c86f 100755
--- a/app/views/oer/market/details.php
+++ b/app/views/oer/market/details.php
@@ -65,6 +65,7 @@
         <? if (!$material['host_id'] && ($material->isMine() || $GLOBALS['perm']->have_perm("root"))) : ?>
             <?= \Studip\LinkButton::create(_('Bearbeiten'), $controller->link_for("oer/mymaterial/edit/".$material->getId()), ['data-dialog' => "1"]) ?>
             <form action="<?= $controller->link_for("oer/mymaterial/edit/".$material->getId()) ?>" method="post" style="display: inline;">
+                <?= CSRFProtection::tokenTag() ?>
                 <?= \Studip\Button::create(_('Löschen'), "delete", ['value' => 1, 'data-confirm' => _('Wirklich löschen?')]) ?>
             </form>
         <? endif ?>
diff --git a/app/views/oer/mymaterial/edit.php b/app/views/oer/mymaterial/edit.php
index a93558a..16401c9 100755
--- a/app/views/oer/mymaterial/edit.php
+++ b/app/views/oer/mymaterial/edit.php
@@ -4,7 +4,7 @@
       onsubmit="$(window).off('beforeunload')"
       data-secure
       enctype="multipart/form-data">
-
+    <?= CSRFProtection::tokenTag() ?>
     <div class="oercampus_editmaterial">
         <fieldset>
             <legend><?= _('Grunddaten') ?></legend>
-- 
cgit v1.0