From f5e3b717ff8d141986115a09ccbd1d9d6992f687 Mon Sep 17 00:00:00 2001
From: glaszig <glaszig@gmail.com>
Date: Wed, 14 Aug 2019 02:41:20 +0200
Subject: [PATCH 1/2] add missing CSRFTokenFieldTag's

---
 includes/dashboard.php  | 1 +
 includes/functions.php  | 2 ++
 includes/networking.php | 1 +
 includes/system.php     | 1 +
 includes/themes.php     | 1 +
 5 files changed, 6 insertions(+)

diff --git a/includes/dashboard.php b/includes/dashboard.php
index 0ee82b05..33a87869 100755
--- a/includes/dashboard.php
+++ b/includes/dashboard.php
@@ -260,6 +260,7 @@ foreach ($clients as $client) {
                  <div class="col-lg-12">
                  <div class="row">
                     <form action="?page=wlan0_info" method="POST">
+                    <?php echo CSRFTokenFieldTag() ?>
                     <?php if (!$wlan0up) {
                         echo '<input type="submit" class="btn btn-success" value="'._("Start ").RASPI_WIFI_CLIENT_INTERFACE.'" name="ifup_wlan0" />';
 } else {
diff --git a/includes/functions.php b/includes/functions.php
index 31286d73..f93e036a 100755
--- a/includes/functions.php
+++ b/includes/functions.php
@@ -315,6 +315,7 @@ function DisplayOpenVPNConfig()
 
                     <h4>Client settings</h4>
                     <form role="form" action="?page=save_hostapd_conf" method="POST">
+                    <?php echo CSRFTokenFieldTag() ?>
 
                     <div class="row">
                         <div class="form-group col-md-4">
@@ -439,6 +440,7 @@ function DisplayTorProxyConfig()
                 <div class="tab-pane fade in active" id="basic">
                     <h4>Basic settings</h4>
                     <form role="form" action="?page=save_hostapd_conf" method="POST">
+                    <?php echo CSRFTokenFieldTag() ?>
                     <div class="row">
                         <div class="form-group col-md-4">
                             <label for="code">VirtualAddrNetwork</label>
diff --git a/includes/networking.php b/includes/networking.php
index 9c330af7..24e9d35d 100755
--- a/includes/networking.php
+++ b/includes/networking.php
@@ -63,6 +63,7 @@ foreach ($interfaces as $interface) {
                         <div class="row">
                           <div class="col-lg-6">
                             <form id="frm-'.htmlspecialchars($interface, ENT_QUOTES).'">
+                            ' . CSRFTokenFieldTag() . '
                               <div class="form-group">
                                 <h4>' . _("Adapter IP Address Settings") . '</h4>
                                 <div class="btn-group" data-toggle="buttons">
diff --git a/includes/system.php b/includes/system.php
index 0de2fe29..0b7c23b0 100755
--- a/includes/system.php
+++ b/includes/system.php
@@ -187,6 +187,7 @@ function DisplaySystem()
           </div>
 
           <form action="?page=system_info" method="POST">
+          <?php echo CSRFTokenFieldTag() ?>
           <input type="submit" class="btn btn-warning" name="system_reboot"   value="<?php echo _("Reboot"); ?>" />
           <input type="submit" class="btn btn-warning" name="system_shutdown" value="<?php echo _("Shutdown"); ?>" />
           <input type="button" class="btn btn-outline btn-primary" value="<?php echo _("Refresh"); ?>" onclick="document.location.reload(true)" />
diff --git a/includes/themes.php b/includes/themes.php
index b0d43788..431e57d0 100755
--- a/includes/themes.php
+++ b/includes/themes.php
@@ -43,6 +43,7 @@ function DisplayThemeConfig()
     </div>
 
     <form action="?page=system_info" method="POST">
+      <?php echo CSRFTokenFieldTag() ?>
       <input type="button" class="btn btn-outline btn-primary" value="<?php echo _("Refresh"); ?>" onclick="document.location.reload(true)" />
     </form>
 

From d2bb1b02b58c4abb42ca9ccae6578053d237865f Mon Sep 17 00:00:00 2001
From: glaszig <glaszig@gmail.com>
Date: Wed, 14 Aug 2019 02:44:13 +0200
Subject: [PATCH 2/2] move CSRFTokenFieldTag up to the opening form tag for
 style and discoverability

---
 includes/hostapd.php | 2 +-
 includes/system.php  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/includes/hostapd.php b/includes/hostapd.php
index 0a425cb5..e7facc94 100755
--- a/includes/hostapd.php
+++ b/includes/hostapd.php
@@ -69,6 +69,7 @@ function DisplayHostAPDConfig()
         <div class="panel-body">
       <p><?php $status->showMessages(); ?></p>
           <form role="form" action="?page=hostapd_conf" method="POST">
+            <?php echo CSRFTokenFieldTag() ?>
             <!-- Nav tabs -->
             <ul class="nav nav-tabs">
               <li class="active"><a href="#basic" data-toggle="tab"><?php echo _("Basic"); ?></a></li>
@@ -82,7 +83,6 @@ function DisplayHostAPDConfig()
                 <div class="tab-pane fade in active" id="basic">
 
                 <h4><?php echo _("Basic settings") ;?></h4>
-                <?php echo CSRFTokenFieldTag() ?>
                 <div class="row">
                   <div class="form-group col-md-4">
                     <label for="cbxinterface"><?php echo _("Interface") ;?></label>
diff --git a/includes/system.php b/includes/system.php
index 0b7c23b0..ed849237 100755
--- a/includes/system.php
+++ b/includes/system.php
@@ -155,6 +155,7 @@ function DisplaySystem()
 
   <p><?php $status->showMessages(); ?></p>
   <form role="form" action="?page=system_info" method="POST">
+  <?php echo CSRFTokenFieldTag() ?>
   <ul class="nav nav-tabs" role="tablist">
     <li role="presentation" class="active systemtab"><a href="#system" aria-controls="system" role="tab" data-toggle="tab"><?php echo _("System"); ?></a></li>
     <li role="presentation" class="languagetab"><a href="#language" aria-controls="language" role="tab" data-toggle="tab"><?php echo _("Language"); ?></a></li>
@@ -198,7 +199,6 @@ function DisplaySystem()
 
     <div role="tabpanel" class="tab-pane" id="language">
       <h4><?php echo _("Language settings") ;?></h4>
-        <?php echo CSRFTokenFieldTag() ?>
       <div class="row">
         <div class="form-group col-md-4">
           <label for="code"><?php echo _("Select a language"); ?></label>