dodanie csrf, oauth 2, dockerfile

source/export_csv.php

@@ -3,7 +3,17 @@ require_once 'includes/db.php';
 require_once 'includes/auth.php';
 checkAuth();
 
+function sanitizeCsvCell($value) {
+    $value = (string)$value;
+    if ($value !== '' && preg_match('/^[=\+\-@]/', $value) === 1) {
+        return "'" . $value;
+    }
+
+    return $value;
+}
+
 if ($_SERVER['REQUEST_METHOD'] === 'POST' && !empty($_POST['order_ids'])) {
+    requireCsrfToken();
     $ids = $_POST['order_ids'];
 
     // Tworzenie znaków zapytania do zapytania SQL (np. ?, ?, ?)
@@ -31,16 +41,16 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST' && !empty($_POST['order_ids'])) {
     foreach ($orders as $o) {
         fputcsv($output, [
             $o['id'],
-            $o['product_name'],
-            $o['part_number'],
+            sanitizeCsvCell($o['product_name']),
+            sanitizeCsvCell($o['part_number']),
             $o['quantity'],
-            $o['purchase_place'],
+            sanitizeCsvCell($o['purchase_place']),
             number_format($o['price_per_unit'], 2, ',', ''), // Cena z przecinkiem dla Excela
-            $o['delivery_date'],
-            $o['recipient'],
-            $o['delivery_address'],
-            $o['status'],
-            $o['notes']
+            sanitizeCsvCell($o['delivery_date']),
+            sanitizeCsvCell($o['recipient']),
+            sanitizeCsvCell($o['delivery_address']),
+            sanitizeCsvCell($o['status']),
+            sanitizeCsvCell($o['notes'])
         ], ';');
     }