1 changed files with 12 additions and 0 deletions
@@ -5,12 +5,24 @@ if (session_status() === PHP_SESSION_NONE) {

 require_once __DIR__ . "/../model/UserManager.php";
 require_once __DIR__ . "/../model/ArticleManager.php";
+require_once __DIR__ . "/../../includes/csrf.php";

 if (!isset($_SESSION["user"])) {
    header("Location: index.php?pfad=login");
    exit();
 }

+if ($_SERVER["REQUEST_METHOD"] !== "POST") {
+    header("Location: ../../index.php?pfad=profile");
+    exit();
+}
+
+if (!csrf_verify()) {
+    $_SESSION["message"] = "invalid_csrf_token";
+    header("Location: ../../index.php?pfad=profile");
+    exit();
+}
+
 /*
    Deregistrierung
    Funktion: Entfernt User aus der Datenbank und beendet die Session