NAK-Reinickendorf/intranet
2
0
Fork 0
Code Issues 2 Pull Requests Actions Projects 1 Wiki Activity

web - refactor core modules, harden authorization, simplify endpoints

Browse Source
This commit is contained in:
samuelbias
2026-08-29 11:15:54 +02:00
parent e1109a07ef
commit 79d857d686
71 changed files with 8269 additions and 9119 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/intranet_repo/projects/adminpanel/admin_inbox.php
+11
View File
@@ -7,6 +7,8 @@
- Info-Nachrichten */
require_once $_SERVER['DOCUMENT_ROOT'].'/intranet_repo/general_files/initialise.php';
require_once $_SERVER['DOCUMENT_ROOT'].'/intranet_repo/projects/authorization/util/authorization_helpers.php';
$authorizationCsrfToken = authorization_csrf_token();
// Admin-Check
$stmt = $pdo->prepare("SELECT \"Admin\" FROM user_permissions WHERE user_id = ?");
@@ -18,6 +20,11 @@
exit();
}
if ($_SERVER['REQUEST_METHOD'] === 'POST' && !authorization_csrf_is_valid($_POST['csrf_token'] ?? null)) {
header('Location: admin_inbox.php?inbox_status=error');
exit();
}
// Typ-Konfiguration für Inbox
$typeConfig = [
'registration' => ['label' => 'Registrierung', 'class' => 'inbox-type-registration'],
@@ -398,12 +405,14 @@
<button type="button" class="inbox-btn inbox-btn-approve" style="background:linear-gradient(135deg,var(--nak-orange),hsl(25,95%,40%)) !important;border-color:hsl(25,95%,40%) !important;" onclick="openBsEscalationModal(<?= (int)$msg['id'] ?>, <?= (int)$data['user_id'] ?>, '<?= htmlspecialchars($data['user_name'] ?? '', ENT_QUOTES) ?>', <?= (int)($data['days_overdue'] ?? 0) ?>)">Persönliche Erinnerung bestätigen</button>
<?php else: ?>
<form method="post" action="">
<input type="hidden" name="csrf_token" value="<?= authorization_html($authorizationCsrfToken) ?>">
<input type="hidden" name="mark_done" value="<?= (int)$msg['id'] ?>">
<button type="submit" class="inbox-btn inbox-btn-done">Als erledigt markieren</button>
</form>
<?php endif; ?>
<?php else: ?>
<form method="post" action="">
<input type="hidden" name="csrf_token" value="<?= authorization_html($authorizationCsrfToken) ?>">
<input type="hidden" name="mark_done" value="<?= (int)$msg['id'] ?>">
<button type="submit" class="inbox-btn inbox-btn-done">Als erledigt markieren</button>
</form>
@@ -453,6 +462,7 @@
<div style="padding:22px 24px 24px 24px;">
<form method="post" action="approve-registration.php" id="regModalForm">
<input type="hidden" name="csrf_token" value="<?= authorization_html($authorizationCsrfToken) ?>">
<input type="hidden" name="pending_id" id="regModalPendingId">
<input type="hidden" name="message_id" id="regModalMessageId">
<input type="hidden" name="action" id="regModalAction">
@@ -542,6 +552,7 @@ document.addEventListener('keydown', function(e) {
</div>
<form method="post" action="" id="bsEscForm">
<input type="hidden" name="csrf_token" value="<?= authorization_html($authorizationCsrfToken) ?>">
<input type="hidden" name="bs_escalation_msg_id" id="bsEscMsgId">
<input type="hidden" name="bs_escalation_user_id" id="bsEscUserId">
<input type="hidden" name="bs_escalation_confirm" value="1">