php/controller/createArticle-controller.php

@@ -6,6 +6,7 @@ require_once '../model/LocalArticleManager.php';
 require_once '../model/ArticleManager.php';
 require_once '../validator/article-validator.php';
 require_once '../../includes/article-block-helper.php';
+require_once '../../includes/csrf.php';
 
 if (!isset($_SESSION["user"])) {
     header("Location: index.php?pfad=login");
@@ -14,6 +15,13 @@ if (!isset($_SESSION["user"])) {
 
 if ($_SERVER["REQUEST_METHOD"] === "POST") {
 
+    // CSRF-Token prüfen, bevor irgendeine Änderung vorgenommen wird
+    if (!csrf_verify()) {
+        $_SESSION["message"] = "invalid_csrf_token";
+        header("location: ../../index.php?pfad=createArticle");
+        exit();
+    }
+
     $uploadDir = __DIR__ . '/../../uploads/';
     if (!file_exists($uploadDir)) {
         mkdir($uploadDir, 0755, true);