LotusGuild/tinker_tickets
4
0
Fork 0
Code Issues 6 Pull Requests Actions Packages Projects Releases Wiki Activity

Ship CSRF-drift + markdown fixes to production #25

Merged
jared merged 5 commits from development into main 2026-07-15 16:54:01 -04:00
Conversation 0 Commits 5 Files Changed 4
+18 -3
2 changed files with 18 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 7a537f46bc - Show all commits
api/add_comment.php
+10 -1
View File
@@ -52,9 +52,15 @@ try {
if (!CsrfMiddleware::validateToken($csrfToken)) { if (!CsrfMiddleware::validateToken($csrfToken)) {
http_response_code(403); http_response_code(403);
header('Content-Type: application/json'); header('Content-Type: application/json');
echo json_encode(['success' => false, 'error' => 'Invalid CSRF token']); echo json_encode([
'success' => false,
'error' => 'Invalid CSRF token',
'csrf_token' => CsrfMiddleware::getToken()
]);
exit; exit;
} }
// Rotate token after successful validation
$newCsrfToken = CsrfMiddleware::rotateToken();
} }
$currentUser = $_SESSION['user']; $currentUser = $_SESSION['user'];
@@ -208,6 +214,9 @@ try {
if ($result['success']) { if ($result['success']) {
$result['user_name'] = $currentUser['display_name'] ?? $currentUser['username']; $result['user_name'] = $currentUser['display_name'] ?? $currentUser['username'];
$result['user_id'] = $userId; $result['user_id'] = $userId;
if (isset($newCsrfToken)) {
$result['csrf_token'] = $newCsrfToken;
}
} }
// Discard any unexpected output // Discard any unexpected output
api/update_ticket.php
+8 -2
View File
@@ -48,9 +48,14 @@ try {
if (!CsrfMiddleware::validateToken($csrfToken)) { if (!CsrfMiddleware::validateToken($csrfToken)) {
http_response_code(403); http_response_code(403);
header('Content-Type: application/json'); header('Content-Type: application/json');
echo json_encode(['success' => false, 'error' => 'Invalid CSRF token']); echo json_encode([
'success' => false,
'error' => 'Invalid CSRF token',
'csrf_token' => CsrfMiddleware::getToken()
]);
exit; exit;
} }
$GLOBALS['newCsrfToken'] = CsrfMiddleware::rotateToken();
} }
$currentUser = $_SESSION['user']; $currentUser = $_SESSION['user'];
@@ -279,7 +284,8 @@ try {
'status' => $updateData['status'], 'status' => $updateData['status'],
'priority' => $updateData['priority'], 'priority' => $updateData['priority'],
'updated_at' => date('Y-m-d H:i:s'), 'updated_at' => date('Y-m-d H:i:s'),
'message' => 'Ticket updated successfully' 'message' => 'Ticket updated successfully',
'csrf_token' => $GLOBALS['newCsrfToken'] ?? null
]; ];
} }
} }