Agenda: Add sec_token param in agenda events #security

Author: jmontoyaa

main/calendar/agenda_js.php

@@ -231,6 +231,8 @@
     $agenda_ajax_url .= '&session_id='.intval($_GET['session_id']);
 }
 
+$agenda_ajax_url .= '&sec_token='.Security::get_token();
+
 $tpl->assign('web_agenda_ajax_url', $agenda_ajax_url);
 
 $form = new FormValidator(

main/inc/ajax/agenda.ajax.php

@@ -35,6 +35,9 @@
         if (!$agenda->getIsAllowedToEdit()) {
             break;
         }
+        if (false === Security::check_token('get')) {
+            exit;
+        }
         $add_as_announcement = isset($_REQUEST['add_as_annonuncement']) ? $_REQUEST['add_as_annonuncement'] : null;
         $title = isset($_REQUEST['title']) ? $_REQUEST['title'] : null;
         $content = isset($_REQUEST['content']) ? $_REQUEST['content'] : null;
@@ -59,6 +62,9 @@
         if (!$agenda->getIsAllowedToEdit()) {
             break;
         }
+        if (false === Security::check_token('get')) {
+            exit;
+        }
         $id_list = explode('_', $_REQUEST['id']);
         $id = $id_list[1];
         $agenda->editEvent(
@@ -74,6 +80,9 @@
         if (!$agenda->getIsAllowedToEdit()) {
             break;
         }
+        if (false === Security::check_token('get')) {
+            exit;
+        }
         $id_list = explode('_', $_REQUEST['id']);
         $id = $id_list[1];
         $deleteAllEventsFromSerie = isset($_REQUEST['delete_all_events']) ? true : false;
@@ -83,6 +92,9 @@
         if (!$agenda->getIsAllowedToEdit()) {
             break;
         }
+        if (false === Security::check_token('get')) {
+            exit;
+        }
         $minute_delta = $_REQUEST['minute_delta'];
         $id = explode('_', $_REQUEST['id']);
         $id = $id[1];
@@ -92,6 +104,9 @@
         if (!$agenda->getIsAllowedToEdit()) {
             break;
         }
+        if (false === Security::check_token('get')) {
+            exit;
+        }
         $minute_delta = $_REQUEST['minute_delta'];
         $allDay = $_REQUEST['all_day'];
         $id = explode('_', $_REQUEST['id']);