Update like-controller.php

2026-07-19 16:05:52 +02:00
parent cd50840b19
commit 59e0b9f111
1 changed files with 13 additions and 0 deletions
@@ -5,6 +5,12 @@ if (session_status() === PHP_SESSION_NONE) {

 require_once __DIR__ . '/../model/Article.php';
 require_once __DIR__ . '/../model/ArticleManager.php';
+require_once __DIR__ . '/../../includes/csrf.php';
+
+if ($_SERVER["REQUEST_METHOD"] !== "POST") {
+    header("Location: ../../index.php");
+    exit();
+}

 // 2. Prüfen, ob eine gültige Artikel-ID übergeben wurde
 if (isset($_GET["id"]) && !empty($_GET["id"])) {
@@ -17,6 +23,13 @@ if (isset($_GET["id"]) && !empty($_GET["id"])) {
        exit();
    }

+    // CSRF-Token prüfen, bevor der Like-Status verändert wird
+    if (!csrf_verify()) {
+        $_SESSION["message"] = "invalid_csrf_token";
+        header("Location: ../../index.php?pfad=showArticle&id=" . $articleId);
+        exit();
+    }
+
    try {
        $articleManager = ArticleManager::getInstance();
        $articleManager->toggleLike($articleId, $userEmail);