Daniel/hotel
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Implemented CSRF token validation on user logout

Browse Source
This commit is contained in:
Aman deep sharma
2025-02-25 16:25:06 +05:30
parent b13ef0a185
commit 89e3e434da
8 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
classes/controller/FrontController.php
View File

@@ -330,7 +330,7 @@ class FrontControllerCore extends Controller
$this->context->customer->logout();
Tools::redirect(isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : null);
} elseif (isset($_GET['mylogout'])) {
} elseif (isset($_GET['mylogout']) && $this->isTokenValid()) {
$this->context->customer->mylogout();
Tools::redirect(isset($_SERVER['HTTP_REFERER']) ? $_SERVER['HTTP_REFERER'] : null);
}

2
modules/blockmyaccount/blockmyaccount.tpl
View File

@@ -35,7 +35,7 @@
{if $voucherAllowed}<li><a href="{$link->getPageLink('discount', true)|escape:'html'}" title="{l s='My vouchers' mod='blockmyaccount'}">{l s='My vouchers' mod='blockmyaccount'}</a></li>{/if}
{$HOOK_BLOCK_MY_ACCOUNT}
</ul>
<p class="logout"><a href="{$link->getPageLink('index', true, NULL, "mylogout")|escape:'html'}" title="{l s='Sign out' mod='blockmyaccount'}">{l s='Sign out' mod='blockmyaccount'}</a></p>
<p class="logout"><a href="{$link->getPageLink('index', true, NULL, "mylogout=1&token={$static_token}")|escape:'html':'UTF-8'}" title="{l s='Sign out' mod='blockmyaccount'}">{l s='Sign out' mod='blockmyaccount'}</a></p>
</div>
</div>
<!-- /Block myaccount module -->

2
modules/blockuserinfo/blockuserinfo.tpl
View File

@@ -52,7 +52,7 @@
{l s='Welcome' mod='blockuserinfo'}
{if $logged}
<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='View my customer account' mod='blockuserinfo'}" class="account" rel="nofollow"><span>{$cookie->customer_firstname} {$cookie->customer_lastname}</span></a>
<a href="{$link->getPageLink('index', true, NULL, "mylogout")|escape:'html'}" title="{l s='Log me out' mod='blockuserinfo'}" class="logout" rel="nofollow">{l s='Sign out' mod='blockuserinfo'}</a>
<a href="{$link->getPageLink('index', true, NULL, "mylogout=1&token={$static_token}")|escape:'html':'UTF-8'}" title="{l s='Log me out' mod='blockuserinfo'}" class="logout" rel="nofollow">{l s='Sign out' mod='blockuserinfo'}</a>
{else}
<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Log in to your customer account' mod='blockuserinfo'}" class="login" rel="nofollow">{l s='Sign in' mod='blockuserinfo'}</a>
{/if}

2
modules/blockuserinfo/nav-xs.tpl
View File

@@ -26,7 +26,7 @@
<a class="navigation-link" href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='View my customer account' mod='blockuserinfo'}">{l s='Accounts Settings' mod='blockuserinfo'}</a>
</li>
<li>
<a class="navigation-link" href="{$link->getPageLink('index', true, NULL, "mylogout")|escape:'html'}" title="{l s='Log me out' mod='blockuserinfo'}">{l s='Sign Out' mod='blockuserinfo'}</a>
<a class="navigation-link" href="{$link->getPageLink('index', true, NULL, "mylogout=1&token={$static_token}")|escape:'html':'UTF-8'}" title="{l s='Log me out' mod='blockuserinfo'}">{l s='Sign Out' mod='blockuserinfo'}</a>
</li>
{else}
<li>

2
modules/blockuserinfo/nav.tpl
View File

@@ -33,7 +33,7 @@
<ul class="dropdown-menu" aria-labelledby="user_info_acc">
<li><a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='View my customer account' mod='blockuserinfo'}">{l s='Accounts' mod='blockuserinfo'}</a></li>
<li><a href="{$link->getPageLink('history', true)|escape:'html'}" title="{l s='View my orders' mod='blockuserinfo'}">{l s='Orders'}</a></li>
<li><a href="{$link->getPageLink('index', true, NULL, "mylogout")|escape:'html'}" title="{l s='Log me out' mod='blockuserinfo'}">{l s='Logout'}</a></li>
<li><a href="{$link->getPageLink('index', true, NULL, "mylogout=1&token={$static_token}")|escape:'html':'UTF-8'}" title="{l s='Log me out' mod='blockuserinfo'}">{l s='Logout'}</a></li>
{block name='displayUserNavigationList'}
{hook h='displayUserNavigationList'}
{/block}

2
themes/hotel-reservation-theme/modules/blockmyaccount/blockmyaccount.tpl
View File

@@ -65,7 +65,7 @@
<div class="logout">
<a
class="btn btn-default button button-small"
href="{$link->getPageLink('index', true, NULL, "mylogout")|escape:'html':'UTF-8'}"
href="{$link->getPageLink('index', true, NULL, "mylogout=1&token={$static_token}")|escape:'html':'UTF-8'}"
title="{l s='Sign out' mod='blockmyaccount'}">
<span>{l s='Sign out' mod='blockmyaccount'}<i class="icon-chevron-right right"></i></span>
</a>

2
themes/hotel-reservation-theme/modules/blockuserinfo/blockuserinfo.tpl
View File

@@ -52,7 +52,7 @@
{l s='Welcome' mod='blockuserinfo'}
{if $logged}
<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='View my customer account' mod='blockuserinfo'}" class="account" rel="nofollow"><span>{$cookie->customer_firstname} {$cookie->customer_lastname}</span></a>
<a href="{$link->getPageLink('index', true, NULL, "mylogout")|escape:'html'}" title="{l s='Log me out' mod='blockuserinfo'}" class="logout" rel="nofollow">{l s='Sign out' mod='blockuserinfo'}</a>
<a href="{$link->getPageLink('index', true, NULL, "mylogout=1&token={$static_token}")|escape:'html':'UTF-8'}" title="{l s='Log me out' mod='blockuserinfo'}" class="logout" rel="nofollow">{l s='Sign out' mod='blockuserinfo'}</a>
{else}
<a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='Log in to your customer account' mod='blockuserinfo'}" class="login" rel="nofollow">{l s='Sign in' mod='blockuserinfo'}</a>
{/if}

2
themes/hotel-reservation-theme/modules/blockuserinfo/nav.tpl
View File

@@ -32,7 +32,7 @@
<ul class="dropdown-menu" aria-labelledby="user_info_acc">
<li><a href="{$link->getPageLink('my-account', true)|escape:'html'}" title="{l s='View my customer account' mod='blockuserinfo'}">{l s='Accounts' mod='blockuserinfo'}</a></li>
<li><a href="{$link->getPageLink('history', true)|escape:'html'}" title="{l s='View my orders' mod='blockuserinfo'}">{l s='Orders'}</a></li>
<li><a href="{$link->getPageLink('index', true, NULL, "mylogout")|escape:'html'}" title="{l s='Log me out' mod='blockuserinfo'}">{l s='Logout'}</a></li>
<li><a href="{$link->getPageLink('index', true, NULL, "mylogout=1&token={$static_token}")|escape:'html':'UTF-8'}" title="{l s='Log me out' mod='blockuserinfo'}">{l s='Logout'}</a></li>
{block name='displayUserNavigationList'}
{hook h='displayUserNavigationList'}
{/block}