-
Jared Hancock authored
Protect againts cross-site request forgery attacks by requiring a special form-field or header to be sent with requests that modify ticket system data. This meant a slight change to the AJAX ticket locking mechanism. It was defined to lock with a GET request; however, GET requests are defined as safe methods and should not modify backend data (such as a lock acquisition). Therefore, the the lock acquire AJAX method was changed to require a POST method. Also remove old, no-longer-used staff panel include files
ff1d8b9e
template.inc.php 4.70 KiB
<?php
if(!defined('OSTADMININC') || !$thisstaff || !$thisstaff->isAdmin()) die('Access Denied');
$info=array();
$qstr='';
if($template && $_REQUEST['a']!='add'){
$title='Update Template';
$action='update';
$submit_text='Save Changes';
$info=$template->getInfo();
$info['id']=$template->getId();
$qstr.='&id='.$template->getId();
}else {
$title='Add New Template';
$action='add';
$submit_text='Add Template';
$info['isactive']=isset($info['isactive'])?$info['isactive']:0;
$qstr.='&a='.urlencode($_REQUEST['a']);
}
$info=Format::htmlchars(($errors && $_POST)?$_POST:$info);
?>
<form action="templates.php?<?php echo $qstr; ?>" method="post" id="save">
<?php csrf_token(); ?>
<input type="hidden" name="do" value="<?php echo $action; ?>">
<input type="hidden" name="a" value="<?php echo Format::htmlchars($_REQUEST['a']); ?>">
<input type="hidden" name="id" value="<?php echo $info['id']; ?>">
<h2>Email Template</h2>
<table class="form_table" width="940" border="0" cellspacing="0" cellpadding="2">
<thead>
<tr>
<th colspan="2">
<h4><?php echo $title; ?></h4>
<em>Template information.</em>
</th>
</tr>
</thead>
<tbody>
<tr>
<td width="180" class="required">
Name:
</td>
<td>
<input type="text" size="30" name="name" value="<?php echo $info['name']; ?>">
<span class="error">* <?php echo $errors['name']; ?></span>
</td>
</tr>
<tr>
<td width="180" class="required">
Status:
</td>
<td>
<input type="radio" name="isactive" value="1" <?php echo $info['isactive']?'checked="checked"':''; ?>><strong>Active</strong>
<input type="radio" name="isactive" value="0" <?php echo !$info['isactive']?'checked="checked"':''; ?>>Disabled
<span class="error">* <?php echo $errors['isactive']; ?></span>
</td>
</tr>
<tr>
<td width="180" class="required">
Language:
</td>
<td>
<select name="lang_id">
<option value="en" selected="selected">English (US)</option>
</select>
<span class="error">* <?php echo $errors['lang_id']; ?></span>
</td>
</tr>
<?php
if($template){ ?>
<tr>