xBeaTz
d97605f801
- Fixed SQL injection vulnerabilities with prepared statements - Added column whitelist protection for dynamic termin updates - Extracted iCloud credentials into protected config file - Moved sensitive configuration files out of webroot - Added authentication and admin checks to PVE APIs - Added CSRF protection to write operations and APIs - Disabled debug output in production mode - Added centralized configuration handling - Protected sensitive directories with access rules - Added initial project security documentation
48 lines
1.3 KiB
PHP
48 lines
1.3 KiB
PHP
<?php
|
|
require_once "config/config.php";
|
|
include("Data.class.php");
|
|
$Data = new Data($pdo);
|
|
require_once "config/session.php";
|
|
|
|
if (!isset($_SESSION["loggedin"]) || $_SESSION["loggedin"] !== true) {
|
|
header("location: index.php");
|
|
exit;
|
|
}
|
|
|
|
if (!isset($_SESSION['role']) || $_SESSION['role'] !== 'admin') {
|
|
http_response_code(403);
|
|
exit("Keine Berechtigung");
|
|
}
|
|
|
|
if (!isset($_POST["id"])) {
|
|
die("Kein Termin angegeben.");
|
|
}
|
|
|
|
// CSRF check
|
|
if (!isset($_POST['csrf_token']) || !isset($_SESSION['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $_POST['csrf_token'])) {
|
|
die("CSRF validation failed");
|
|
}
|
|
|
|
$id = intval($_POST["id"]);
|
|
|
|
$Data->deleteCalendarEvent($id);
|
|
|
|
// --------------------------------------------------
|
|
// 2) Changelog löschen
|
|
// --------------------------------------------------
|
|
$pdo->prepare("DELETE FROM changes WHERE termin_id = :id")
|
|
->execute([':id' => $id]);
|
|
|
|
// --------------------------------------------------
|
|
// 3) Termin löschen
|
|
// --------------------------------------------------
|
|
$pdo->prepare("DELETE FROM termine WHERE id = :id")
|
|
->execute([':id' => $id]);
|
|
|
|
// --------------------------------------------------
|
|
// Weiterleitung
|
|
// --------------------------------------------------
|
|
header("Location: termine.php");
|
|
exit;
|
|
</create_file>
|