SEC: ensure actions and graph data are not available without authenti…

…cation
vampirismtrueblood · Mar 4, 2017 · f712d7c · f712d7c
1 parent 863cf9c
commit f712d7c
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 0 deletions.
diff --git a/actions_add_remove.php b/actions_add_remove.php
@@ -20,6 +20,12 @@
     You should have received a copy of the GNU General Public License
     along with Foobar.  If not, see <http://www.gnu.org/licenses/>.
  */
+session_start();
+session_cache_limiter('nocache');
+$cache_limiter = session_cache_limiter();
+
+if (!isset($_SESSION['loggedin'])) exit();
+
 require_once ('inc/db.php');
 
 function Redirect_Servers ($server, $permanent = false) {

diff --git a/getgraph.php b/getgraph.php
@@ -1,4 +1,10 @@
 <?php
+session_start();
+session_cache_limiter('nocache');
+$cache_limiter = session_cache_limiter();
+
+if (!isset($_SESSION['loggedin'])) exit();
+
 require_once 'inc/db.php';
 $dblink = db_connect();
 // Packages with updates