web - refactor core modules, harden authorization, simplify endpoints

web/intranet_repo/projects/adminpanel/approve-registration.php

@@ -6,6 +6,7 @@
 
 	require_once $_SERVER['DOCUMENT_ROOT'].'/intranet_repo/general_files/initialise.php';
 	require_once $_SERVER['DOCUMENT_ROOT'].'/intranet_repo/general_files/ini/send_mail.php';
+	require_once $_SERVER['DOCUMENT_ROOT'].'/intranet_repo/projects/authorization/util/authorization_helpers.php';
 
 	// Admin-Check
 	$stmt = $pdo->prepare("SELECT \"Admin\" FROM user_permissions WHERE user_id = ?");
@@ -22,6 +23,11 @@
 		exit();
 	}
 
+	if (!authorization_csrf_is_valid($_POST['csrf_token'] ?? null)) {
+		header("Location: admin_inbox.php?inbox_status=error");
+		exit();
+	}
+
 	// Admin-Name ermitteln
 	$adminName = trim(($user['first_name'] ?? '') . ' ' . ($user['last_name'] ?? ''));
 	if (empty($adminName)) $adminName = 'Ein Administrator';