diff --git a/admin-dev/filemanager/config/config.php b/admin-dev/filemanager/config/config.php index 334e16a92..2e4d977e0 100644 --- a/admin-dev/filemanager/config/config.php +++ b/admin-dev/filemanager/config/config.php @@ -18,6 +18,13 @@ $cms_accesses = Profile::getProfileAccess(Context::getContext()->employee->id_pr if (!$products_accesses['edit'] && !$cms_accesses['edit']) { die(Tools::displayError()); } + +$tokenTab = $products_accesses['edit'] ? 'AdminProducts' : 'AdminCmsContent'; +$isMutatingRequest = isset($_POST['submit']) || in_array(basename($_SERVER['SCRIPT_NAME']), array('execute.php', 'upload.php', 'ajax_calls.php'), true); + +if ($isMutatingRequest && (!isset($_REQUEST['token']) || !hash_equals(Tools::getAdminTokenLite($tokenTab), (string) $_REQUEST['token']))) { + die('invalid token'); +} //------------------------------------------------------------------------------ // DON'T COPY THIS VARIABLES IN FOLDERS config.php FILES //------------------------------------------------------------------------------ diff --git a/admin-dev/filemanager/dialog.php b/admin-dev/filemanager/dialog.php index 48f4945d2..7f0d1de1f 100644 --- a/admin-dev/filemanager/dialog.php +++ b/admin-dev/filemanager/dialog.php @@ -242,6 +242,7 @@ if (isset($_POST['submit'])) {