marek-miklewicz/global-autoresponder
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: scope csrf fields and block past dates

Browse Source
This commit is contained in:
Marek Miklewicz
2026-06-02 21:54:56 +02:00
parent 56709817b5
commit 767016c659
8 changed files with 101 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
exec/lib/AppContext.php
+10 -4
View File
@@ -58,14 +58,14 @@ final class AppContext
public function csrfField(string $intent): string
{
$issued = $this->csrf->issue($intent);
return '<input type="hidden" name="csrf_ts" value="' . self::e((string)$issued['ts']) . '">' .
'<input type="hidden" name="csrf_sid" value="' . self::e($issued['sid']) . '">' .
'<input type="hidden" name="csrf_token" value="' . self::e($issued['token']) . '">';
return '<input type="hidden" name="gar_csrf_ts" value="' . self::e((string)$issued['ts']) . '">' .
'<input type="hidden" name="gar_csrf_sid" value="' . self::e($issued['sid']) . '">' .
'<input type="hidden" name="gar_csrf_token" value="' . self::e($issued['token']) . '">';
}
public function requireCsrf(string $intent): void
{
if (!$this->csrf->validate($intent, $this->post('csrf_ts'), $this->post('csrf_token'), 3600, $this->post('csrf_sid'))) {
if (!$this->csrf->validate($intent, $this->post('gar_csrf_ts'), $this->post('gar_csrf_token'), 3600, $this->post('gar_csrf_sid'))) {
throw new RuntimeException('Nieprawidłowy lub wygasły token CSRF.');
}
}
@@ -158,6 +158,7 @@ final class AppContext
}
function renderMonth(calendar, year, month) {
var selected = calendar.getAttribute('data-selected-date') || '';
var minDate = calendar.getAttribute('data-min-date') || '';
var tbody = calendar.querySelector('[data-calendar-days]');
var label = calendar.querySelector('[data-calendar-month-label]');
if (!tbody || !label) { return; }
@@ -174,6 +175,11 @@ final class AppContext
continue;
}
var value = year + '-' + pad(month) + '-' + pad(day);
if (minDate && value < minDate) {
html += '<td><span class="br-cal-day-disabled">' + day + '</span></td>';
day++;
continue;
}
var cls = value === selected ? ' is-selected' : '';
html += '<td><button type="button" class="br-cal-day' + cls + '" data-date-target="' + calendar.getAttribute('data-calendar-name') + '_date" data-date-label="' + calendar.getAttribute('data-calendar-name') + '_label" data-date-value="' + value + '">' + day + '</button></td>';
day++;