Don't forget the staff login and emailtest pages

include/class.csrf.php

@@ -40,6 +40,10 @@ function csrf_get_token($length=32) {
 }
 
 function csrf_ensure_cookie() {
+    global $csrf_unprotected;
+    if ($csrf_unprotected)
+        return true;
+
     $token = csrf_get_token();
     if (isset($_POST['__CSRFToken__'])) {
         if ($token == $_POST['__CSRFToken__'])
@@ -52,6 +56,11 @@ function csrf_ensure_cookie() {
     Http::response(400, 'CSRF Token Required');
 }
 
+function csrf_unprotect() {
+    global $csrf_unprotected;
+    $csrf_unprotected = true;
+}
+
 # Many thanks to https://docs.djangoproject.com/en/dev/ref/contrib/csrf/
 function csrf_enable_ajax() { ?>
 <script type="text/javascript">

include/staff/login.tpl.php

@@ -15,6 +15,7 @@
     <h1 id="logo"><a href="index.php">osTicket Staff Control Panel</a></h1>
     <h3><?php echo Format::htmlchars($msg); ?></h3>
     <form action="login.php" method="post">
+        <?php csrf_token(); ?>
         <input type="hidden" name="d"o value="scplogin">
         <fieldset>
             <input type="text" name="username" id="name" value="" placeholder="username" autocorrect="off" autocapitalize="off">

scp/emailtest.php

@@ -15,6 +15,7 @@
 **********************************************************************/
 require('admin.inc.php');
 include_once(INCLUDE_DIR.'class.email.php');
+include_once(INCLUDE_DIR.'class.csrf.php');
 $info=array();
 $info['subj']='osTicket test email';
 
@@ -47,6 +48,7 @@ $nav->setTabActive('emails');
 require(STAFFINC_DIR.'header.inc.php');
 ?>
 <form action="emailtest.php" method="post" id="emailtest">
+ <?php csrf_token(); ?>
  <input type="hidden" name="do" value="<?php echo $action; ?>">
  <h2>Test Outgoing Email</h2>
  <table class="form_table" width="940" border="0" cellspacing="0" cellpadding="2">

scp/login.php

@@ -17,6 +17,7 @@ require_once('../main.inc.php');
 if(!defined('INCLUDE_DIR')) die('Fatal Error. Kwaheri!');
 
 require_once(INCLUDE_DIR.'class.staff.php');
+require_once(INCLUDE_DIR.'class.csrf.php');
 
 $msg=$_SESSION['_staff']['auth']['msg'];
 $msg=$msg?$msg:'Authentication Required';