From 12801344f10ce8fc546e9a7f0af862daf885de33 Mon Sep 17 00:00:00 2001
From: NOrtmann1 <ortmann.niklas@yahoo.de>
Date: Sun, 19 Jul 2026 15:42:28 +0200
Subject: [PATCH] Update profile-controller.php

---
 php/controller/profile-controller.php | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/php/controller/profile-controller.php b/php/controller/profile-controller.php
index 3d5cc42..37501c1 100644
--- a/php/controller/profile-controller.php
+++ b/php/controller/profile-controller.php
@@ -5,6 +5,7 @@ require_once "php/model/Article.php";
 require_once "php/model/ArticleManager.php";
 require_once "php/model/CommentManager.php";
 require_once "php/validator/user-validator.php";
+require_once "includes/csrf.php";
 
 $error = null;
 
@@ -27,6 +28,7 @@ try {
     }
 
     if ($_SERVER["REQUEST_METHOD"] === "POST" && isset($_POST["saveProfile"])) {
+
         $oldEmail = $_SESSION["user_email"];
 
         $newEmail = trim($_POST["email"] ?? "");
@@ -34,7 +36,12 @@ try {
         $nachname = trim($_POST["nachname"] ?? "");
         $password = $_POST["password"] ?? "";
 
-        if (!userEmailValidator($newEmail)) {
+        if (!csrf_verify()) {
+            // CSRF-Token prüfen, bevor irgendeine Änderung vorgenommen wird
+            $error = "Deine Sitzung ist abgelaufen. Bitte lade die Seite neu und versuche es erneut.";
+            $_GET["edit"] = "1";
+
+        } elseif (!userEmailValidator($newEmail)) {
             $error = "Bitte gib eine gültige E-Mail-Adresse ein.";
             $_GET["edit"] = "1";