albert/Zeszyt_2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

dodanie csrf, oauth 2, dockerfile

Browse Source
This commit is contained in:
Marcin Cieślikowski
2026-03-16 10:43:19 +01:00
parent 56c7ecff6d
commit df448ea7c1
26 changed files with 916 additions and 318 deletions
Download Patch File Download Diff File Expand all files Collapse all files
source/index.php
+9 -5
View File
@@ -59,6 +59,7 @@ $stmt->execute($params);
$orders = $stmt->fetchAll();
$logo_path = $pdo->query("SELECT setting_value FROM " . DB_PREFIX . "settings WHERE setting_key = 'logo_path'")->fetchColumn() ?: 'assets/default_logo.png';
$csrf_token = getCsrfToken();
function getStatusClass($status) {
return match($status) {
@@ -102,7 +103,7 @@ function getStatusClass($status) {
<a class="navbar-brand d-flex align-items-center m-0" href="index.php">
<?php if(file_exists($logo_path)): ?>
<img src="<?php echo $logo_path; ?>" alt="Logo" class="logo-img">
<img src="<?php echo e($logo_path); ?>" alt="Logo" class="logo-img">
<?php else: ?>
<span class="fs-4">💻</span>
<?php endif; ?>
@@ -114,7 +115,7 @@ function getStatusClass($status) {
<div class="d-flex ms-auto align-items-center gap-2">
<button class="btn btn-sm btn-outline-secondary" onclick="toggleDarkMode()"><i class="bi bi-moon-stars" id="themeIcon"></i></button>
<span class="text-light small d-none d-lg-inline me-2">Witaj, <strong><?php echo $_SESSION['username']; ?></strong></span>
<span class="text-light small d-none d-lg-inline me-2">Witaj, <strong><?php echo e($_SESSION['username']); ?></strong></span>
<a class="btn btn-outline-light btn-sm" href="change_password.php"><i class="bi bi-key"></i> Hasło</a>
<?php if ($_SESSION['role'] === 'admin'): ?>
<a class="btn btn-outline-warning btn-sm" href="admin.php"><i class="bi bi-gear"></i> Admin</a>
@@ -193,6 +194,7 @@ function getStatusClass($status) {
</div>
<form method="POST" id="bulkForm">
<?php echo csrfInput(); ?>
<div class="table-container p-0 overflow-hidden mb-3">
<div class="table-responsive">
<table class="table table-hover mb-0 align-middle">
@@ -421,6 +423,8 @@ function getStatusClass($status) {
</div>
<script>
const csrfToken = <?php echo json_encode($csrf_token); ?>;
async function performAction(orderId, actionType) {
let confirmMsg = actionType === 'archive'
? "Czy na pewno chcesz przenieść to zamówienie do archiwum?"
@@ -432,7 +436,7 @@ function getStatusClass($status) {
let response = await fetch('ajax_action.php', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ id: orderId, action: actionType })
body: JSON.stringify({ id: orderId, action: actionType, csrf_token: csrfToken })
});
let resData = await response.json();
@@ -517,7 +521,7 @@ function getStatusClass($status) {
let response = await fetch('ajax_edit.php', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ id: orderId, field: fieldName, value: newValue })
body: JSON.stringify({ id: orderId, field: fieldName, value: newValue, csrf_token: csrfToken })
});
let resData = await response.json();
if(resData.success) {
@@ -582,7 +586,7 @@ function getStatusClass($status) {
let response = await fetch('ajax_add_row.php', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ product_name: prod, quantity: qty, purchase_place: place, price_per_unit: price })
body: JSON.stringify({ product_name: prod, quantity: qty, purchase_place: place, price_per_unit: price, csrf_token: csrfToken })
});
let resData = await response.json();