Add CSRF protections to state-changing endpoints

2025-03-18 11:46:23 -04:00
parent f709c23bcc
commit d23cefa8a9
23 changed files with 239 additions and 79 deletions
--- a/removeUser.php
+++ b/removeUser.php
@@ -3,6 +3,13 @@ require 'config.php';
 header('Content-Type: application/json');

 $usersFile = USERS_DIR . USERS_FILE;
+$headers = array_change_key_case(getallheaders(), CASE_LOWER);
+$receivedToken = isset($headers['x-csrf-token']) ? trim($headers['x-csrf-token']) : '';
+if ($receivedToken !== $_SESSION['csrf_token']) {
+    echo json_encode(["error" => "Invalid CSRF token"]);
+    http_response_code(403);
+    exit;
+}

 // Only allow admins to remove users
 if (