yanglc/OneManager-php
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix CSRF, try fix %20

Browse Source
This commit is contained in:
root
2021-10-06 08:01:31 +00:00
parent 76249edf4d
commit 9205015782
9 changed files with 135 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files
theme/classic.html
+15 -8
View File
@@ -94,12 +94,12 @@
</ul></li>
<!--AdminEnd-->
&nbsp;
<select class="changelanguage" name="language" onchange="changelanguage(this.options[this.options.selectedIndex].value)">
<!--<select class="changelanguage" name="language" onchange="changelanguage(this.options[this.options.selectedIndex].value)">
<option value="">Language</option>
<!--SelectLanguageStart-->
<option value="<!--SelectLanguageKey-->" <!--SelectLanguageSelected-->><!--SelectLanguageValue--></option>
<!--SelectLanguageEnd-->
</select>
</select>-->
</div>
<!--NeedUpdateStart-->
<div style='position:absolute;'><font color='red'><!--constStr@NeedUpdate--></font></div>
@@ -202,6 +202,7 @@
<div id="txt">
<!--AdminStart-->
<form id="txt-form" action="" method="POST">
<input name="_admin" type="hidden" value="">
<a onclick="document.getElementById('txt-a').readOnly='';document.getElementById('txt-save').style.display='';document.getElementById('txt-editbutton').style.display='none';document.getElementById('txt-cancelbutton').style.display='';" id="txt-editbutton"><ion-icon name="create"></ion-icon><!--constStr@ClicktoEdit--></a>
<a onclick="document.getElementById('txt-a').readOnly='readonly';document.getElementById('txt-save').style.display='none';document.getElementById('txt-editbutton').style.display='';document.getElementById('txt-cancelbutton').style.display='none';" id="txt-cancelbutton" style="display:none"><ion-icon name="close"></ion-icon><!--constStr@CancelEdit--></a>&nbsp;&nbsp;&nbsp;
<a id="txt-save" style="display:none"><ion-icon name="save"></ion-icon><!--constStr@Save--></a>
@@ -209,6 +210,12 @@
<textarea id="txt-a" name="editfile" readonly style="width: 100%; margin-top: 2px;" <!--AdminStart-->onchange="document.getElementById('txt-save').onclick=function(){document.getElementById('txt-form').submit();}"<!--AdminEnd--> ><!--TxtContent--></textarea>
<!--AdminStart-->
</form>
<script>
var inputAdminStorage = document.getElementsByName("_admin");
for (i=0;i<inputAdminStorage.length;i++) {
inputAdminStorage[i].value = localStorage.getItem("admin");
}
</script>
<!--AdminEnd-->
</div>
<!--IstxtFileEnd-->
@@ -988,7 +995,7 @@
delete uploading[upbigfilename];
}
}
xhr1.send('upbigfilename='+ upbigfilename +'&filesize='+ file.size +'&filelastModified='+ file.lastModified +'&filemd5='+ filemd5);
xhr1.send('upbigfilename='+ upbigfilename +'&filesize='+ file.size +'&filelastModified='+ file.lastModified +'&filemd5='+ filemd5 + '&_admin=' + localStorage.getItem("admin"));
<!--GuestStart-->
}
}
@@ -1239,7 +1246,7 @@
getuplink(i);
}*/
}
xhr1.send('upbigfilename='+ upbigfilename +'&filesize='+ file.size +'&filelastModified='+ file.lastModified + '&filesha1=' + filesha1 + '&chunksize=' + chunksize);
xhr1.send('upbigfilename='+ upbigfilename +'&filesize='+ file.size +'&filelastModified='+ file.lastModified + '&filesha1=' + filesha1 + '&chunksize=' + chunksize + '&_admin=' + localStorage.getItem("admin"));
}
}
}
@@ -1325,7 +1332,7 @@
}
delete uploading[filename];
}
xhr1.send('uploadid=' + uploadid + '&fileid=' + fileid + '&etag=' + JSON.stringify(res['ETag']));
xhr1.send('uploadid=' + uploadid + '&fileid=' + fileid + '&etag=' + JSON.stringify(res['ETag']) + '&_admin=' + localStorage.getItem("admin"));
} else {
var binary = this.result;
var xhr = new XMLHttpRequest();
@@ -1396,7 +1403,7 @@
}
delete uploading[filename];
}
xhr1.send('uploadid=' + uploadid + '&fileid=' + fileid + '&etag=' + JSON.stringify(res['ETag']));
xhr1.send('uploadid=' + uploadid + '&fileid=' + fileid + '&etag=' + JSON.stringify(res['ETag']) + '&_admin=' + localStorage.getItem("admin"));
// uploadbuttonshow();
} else {
readblob(asize);
@@ -1439,7 +1446,7 @@
var expd = new Date();
expd.setTime(expd.getTime()+1000);
var expires = "expires="+expd.toGMTString();
document.cookie = "admin=; path=/; "+expires;
document.cookie = "admin=; path=<!--base_path-->; "+expires;
location.href = location.href;
}
/*for some mobile browser*/
@@ -1533,7 +1540,7 @@
document.getElementById(str+'_div').style.display='none';
document.getElementById('mask').style.display='none';
}
xhr.send(serializeForm(str+'_form'));
xhr.send(serializeForm(str+'_form') + '&_admin=' + localStorage.getItem("admin"));
return false;
}
function addelement(html) {