From: Paul Hänsch <paul@plutz.net>
Date: Wed, 11 May 2022 15:24:48 +0000 (+0200)
Subject: acl and session validation for attachment ops
X-Git-Url: https://git.plutz.net/?a=commitdiff_plain;h=5a8bbbe98c5b550dc6ebb3bd86fab2211b44df8e;p=shellwiki

acl and session validation for attachment ops
---

diff --git a/themes/default.sh b/themes/default.sh
index 7edd4b9..9826a79 100755
--- a/themes/default.sh
+++ b/themes/default.sh
@@ -114,11 +114,13 @@ theme_attachments(){
 	  $(theme_header)
 	  <main>
 	    <form class=upload method=POST enctype="multipart/form-data">
+	      <input type=hidden name=session_id value="$SESSION_ID">
 	      <input type=file name=file multiple>
 	      <button type=submit name=action value=upload>Upload</button>
 	    </form>
 
             <form method=POST><ul class="attachment list">
+	      <input type=hidden name=session_key value="$SESSION_KEY">
 	    $(for file in "$_EXEC/pages/$page/#attachments"/* "$_DATA/pages/$page/#attachments"/*; do
 	      [ "$file" = "$_EXEC/pages/$page/#attachments/${file##*/}" \
 	            -a -f "$_DATA/pages/$page/#attachments/${file##*/}" ] && continue