CVE-2024-25344: Insufficient Information (NVD-CWE-noinfo)
value: Cross Site Scripting vulnerability in ITFlow.org before commit v.432488eca3998c5be6b6b9e8f8ba01f54bc12378 allows a remtoe attacker to execute arbitrary code and obtain sensitive information via the settings.php, settings+company.php, settings_defaults.php,settings_integrations.php, settings_invoice.php, settings_localization.php, settings_mail.php components.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-26T16:27Z
Repository: https://github.com/itflow-org/itflow
Language: PHP
Files changed: post/setting.php, post/tax.php, settings_alerts.php, settings_backup.php, settings_company.php, settings_defaults.php, settings_integrations.php, settings_invoice.php, settings_localization.php, settings_mail.php, settings_modules.php, settings_quote.php, settings_security.php, settings_tax_add_modal.php, settings_tax_edit_modal.php, settings_taxes.php, settings_telemetry.php, settings_theme.php, settings_ticket.php
Commit date: 2023-11-25 18:15:25 +0000
Commit message: Require CSRF token to edit more admin settings - thanks again to @stehled

Diff: diff --git a/post/setting.php b/post/setting.php
index 25e59e1e..7e41ffe4 100644
--- a/post/setting.php
+++ b/post/setting.php
@@ -4,10 +4,11 @@
  * ITFlow - GET/POST request handler for ITFlow app settings (admin)
  */
 
 if (isset($_POST['edit_company'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
     validateAdminRole();
 
     require_once 'post/setting_company_model.php';
 
 
@@ -51,10 +52,11 @@ if (isset($_POST['edit_company'])) {
 
 }
 
 if (isset($_POST['edit_localization'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
     validateAdminRole();
 
     $locale = sanitizeInput($_POST['locale']);
     $currency_code = sanitizeInput($_POST['currency_code']);
     $timezone = sanitizeInput($_POST['timezone']);
@@ -72,10 +74,11 @@ if (isset($_POST['edit_localization'])) {
 
 }
 
 if (isset($_POST['edit_mail_smtp_settings'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
     validateAdminRole();
 
     $config_smtp_host = sanitizeInput($_POST['config_smtp_host']);
     $config_smtp_port = intval($_POST['config_smtp_port']);
     $config_smtp_encryption = sanitizeInput($_POST['config_smtp_encryption']);
@@ -93,10 +96,11 @@ if (isset($_POST['edit_mail_smtp_settings'])) {
 
 }
 
 if (isset($_POST['edit_mail_imap_settings'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
     validateAdminRole();
 
     $config_imap_host = sanitizeInput($_POST['config_imap_host']);
     $config_imap_username = sanitizeInput($_POST['config_imap_username']);
     $config_imap_password = sanitizeInput($_POST['config_imap_password']);
@@ -115,10 +119,11 @@ if (isset($_POST['edit_mail_imap_settings'])) {
 
 }
 
 if (isset($_POST['edit_mail_from_settings'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
     validateAdminRole();
 
     $config_mail_from_email = sanitizeInput($_POST['config_mail_from_email']);
     $config_mail_from_name = sanitizeInput($_POST['config_mail_from_name']);
 
@@ -142,10 +147,11 @@ if (isset($_POST['edit_mail_from_settings'])) {
 
 }
 
 if (isset($_POST['test_email_smtp'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
     validateAdminRole();
     $email_from = sanitizeInput($_POST['email_from']);
     $email_to = sanitizeInput($_POST['email_to']);
     $subject = "Hi'ya there Chap";
     $body    = "Hello there Chap ;) Don't worry this won't hurt a bit, it's just a test";
@@ -165,10 +171,11 @@ if (isset($_POST['test_email_smtp'])) {
     header("Location: " . $_SERVER["HTTP_REFERER"]);
 }
 
 if (isset($_POST['test_email_imap'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
     validateAdminRole();
 
     // Prepare connection string with encryption (TLS/SSL/<blank>)
     $imap_mailbox = "$config_imap_host:$config_imap_port/imap/readonly/$config_imap_encryption";
 
@@ -186,10 +193,11 @@ if (isset($_POST['test_email_imap'])) {
 
 }
 
 if (isset($_POST['edit_invoice_settings'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
     validateAdminRole();
 
     $config_invoice_prefix = sanitizeInput($_POST['config_invoice_prefix']);
     $config_invoice_next_number = intval($_POST['config_invoice_next_number']);
     $config_invoice_footer = sanitizeInput($_POST['config_invoice_footer']);
@@ -210,10 +218,11 @@ if (isset($_POST['edit_invoice_settings'])) {
 
 }
 
 if (isset($_POST['edit_quote_settings'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
     validateAdminRole();
 
     $config_quote_prefix = sanitizeInput($_POST['config_quote_prefix']);
     $config_quote_next_number = intval($_POST['config_quote_next_number']);
     $config_quote_footer = sanitizeInput($_POST['config_quote_footer']);
@@ -252,10 +261,11 @@ if (isset($_POST['edit_ticket_settings'])) {
 
 }
 
 if (isset($_POST['edit_default_settings'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
     validateAdminRole();
 
     $start_page = sanitizeInput($_POST['start_page']);
     $expense_account = intval($_POST['expense_account']);
     $payment_account = intval($_POST['payment_account']);
@@ -277,10 +287,11 @@ if (isset($_POST['edit_default_settings'])) {
     header("Location: " . $_SERVER["HTTP_REFERER"]);
 }
 
 if (isset($_POST['edit_theme_settings'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
     validateAdminRole();
 
     $theme = preg_replace("/[^0-9a-zA-Z-]/", "", sanitizeInput($_POST['theme']));
 
     mysqli_query($mysqli,"UPDATE settings SET config_theme = '$theme' WHERE company_id = 1");
@@ -293,10 +304,11 @@ if (isset($_POST['edit_theme_settings'])) {
     header("Location: " . $_SERVER["HTTP_REFERER"]);
 }
 
 if (isset($_POST['edit_alert_settings'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
     validateAdminRole();
 
     $config_enable_cron = intval($_POST['config_enable_cron']);
     $config_cron_key = sanitizeInput($_POST['config_cron_key']);
     $config_enable_alert_domain_expire = intval($_POST['config_enable_alert_domain_expire']);
@@ -349,10 +361,11 @@ if (isset($_POST['edit_online_payment_settings'])) {
     header("Location: " . $_SERVER["HTTP_REFERER"]);
 }
 
 if (isset($_POST['edit_integrations_settings'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
     validateAdminRole();
 
     $azure_client_id = sanitizeInput($_POST['azure_client_id']);
     $azure_client_secret = sanitizeInput($_POST['azure_client_secret']);
 
@@ -386,10 +399,12 @@ if (isset($_POST['edit_module_settings'])) {
     header("Location: " . $_SERVER["HTTP_REFERER"]);
 
 }
 
 if (isset($_POST['edit_security_settings'])) {
+
+    validateCSRFToken($_POST['csrf_token']);
     validateAdminRole();
 
     $config_login_message = sanitizeInput($_POST['config_login_message']);
     $config_login_key_required = intval($_POST['config_login_key_required']);
     $config_login_key_secret = sanitizeInput($_POST['config_login_key_secret']);
@@ -404,10 +419,11 @@ if (isset($_POST['edit_security_settings'])) {
     header("Location: " . $_SERVER["HTTP_REFERER"]);
 }
 
 if (isset($_POST['edit_telemetry_settings'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
     validateAdminRole();
 
     $config_telemetry = intval($_POST['config_telemetry']);
 
     mysqli_query($mysqli,"UPDATE settings SET config_telemetry = $config_telemetry WHERE company_id = 1");
@@ -695,10 +711,11 @@ if (isset($_POST['send_telemetry_data'])) {
 
 }
 
 if (isset($_GET['download_database'])) {
 
+    validateCSRFToken($_GET['csrf_token']);
     validateAdminRole();
 
     // Get All Table Names From the Database
     $tables = array();
     $sql = "SHOW TABLES";
diff --git a/post/tax.php b/post/tax.php
index d6455bcd..3254e4e8 100644
--- a/post/tax.php
+++ b/post/tax.php
@@ -4,10 +4,11 @@
  * ITFlow - GET/POST request handler for tax
  */
 
 if (isset($_POST['add_tax'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
     $name = sanitizeInput($_POST['name']);
     $percent = floatval($_POST['percent']);
 
     mysqli_query($mysqli,"INSERT INTO taxes SET tax_name = '$name', tax_percent = $percent");
 
@@ -20,10 +21,11 @@ if (isset($_POST['add_tax'])) {
 
 }
 
 if (isset($_POST['edit_tax'])) {
 
+    validateCSRFToken($_POST['csrf_token']);
     $tax_id = intval($_POST['tax_id']);
     $name = sanitizeInput($_POST['name']);
     $percent = floatval($_POST['percent']);
 
     mysqli_query($mysqli,"UPDATE taxes SET tax_name = '$name', tax_percent = $percent WHERE tax_id = $tax_id");
@@ -36,10 +38,11 @@ if (isset($_POST['edit_tax'])) {
     header("Location: " . $_SERVER["HTTP_REFERER"]);
 
 }
 
 if (isset($_GET['archive_tax'])) {
+    validateCSRFToken($_GET['csrf_token']);
     $tax_id = intval($_GET['archive_tax']);
 
     mysqli_query($mysqli,"UPDATE taxes SET tax_archived_at = NOW() WHERE tax_id = $tax_id");
 
     //logging
diff --git a/settings_alerts.php b/settings_alerts.php
index 5d852f6c..7386d694 100644
--- a/settings_alerts.php
+++ b/settings_alerts.php
@@ -6,10 +6,11 @@ require_once "inc_all_settings.php";
         <div class="card-header py-3">
             <h3 class="card-title"><i class="fas fa-fw fa-bell mr-2"></i>Alerts</h3>
         </div>
         <div class="card-body">
             <form action="post.php" method="post" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
                 <div class="form-group">
                     <div class="custom-control custom-switch">
                         <input type="checkbox" class="custom-control-input" name="config_enable_cron" <?php if ($config_enable_cron == 1) { echo "checked"; } ?> value="1" id="enableCronSwitch">
                         <label class="custom-control-label" for="enableCronSwitch">Enable Cron <small>(cron.php must also be added to cron and run daily at 1:00AM for alerts to work)</small></label>
diff --git a/settings_backup.php b/settings_backup.php
index 3960d1bc..89434e7b 100644
--- a/settings_backup.php
+++ b/settings_backup.php
@@ -5,11 +5,11 @@ require_once "inc_all_settings.php";
     <div class="card card-dark mb-3">
         <div class="card-header py-3">
             <h3 class="card-title"><i class="fas fa-fw fa-database mr-2"></i>Download Database</h3>
         </div>
         <div class="card-body" style="text-align: center;">
-            <a class="btn btn-primary btn-lg p-3" href="post.php?download_database"><i class="fas fa-fw fa-4x fa-download"></i><br><br>Download</a>
+            <a class="btn btn-primary btn-lg p-3" href="post.php?download_database&csrf_token=<?php echo $_SESSION['csrf_token'] ?>"><i class="fas fa-fw fa-4x fa-download"></i><br><br>Download</a>
         </div>
     </div>
 
     <div class="card card-dark">
         <div class="card-header py-3">
diff --git a/settings_company.php b/settings_company.php
index 96f4222e..bd0fef91 100644
--- a/settings_company.php
+++ b/settings_company.php
@@ -27,10 +27,11 @@ $company_initials = nullable_htmlentities(initials($company_name));
         <div class="card-header py-3">
             <h3 class="card-title"><i class="fas fa-fw fa-briefcase mr-2"></i>Company Details</h3>
         </div>
         <div class="card-body">
             <form action="post.php" method="post" enctype="multipart/form-data" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
                 <div class="form-group">
                     <label>Name <strong class="text-danger">*</strong></label>
                     <div class="input-group">
                         <div class="input-group-prepend">
diff --git a/settings_defaults.php b/settings_defaults.php
index 7557a3d8..6a309e7f 100644
--- a/settings_defaults.php
+++ b/settings_defaults.php
@@ -7,10 +7,11 @@ require_once "inc_all_settings.php";
     <div class="card-header py-3">
         <h3 class="card-title"><i class="fas fa-fw fa-cogs mr-2"></i>Defaults</h3>
     </div>
     <div class="card-body">
         <form action="post.php" method="post" autocomplete="off">
+            <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
             <div class="form-group">
                 <label>Start Page</label>
                 <div class="input-group">
                     <div class="input-group-prepend">
@@ -19,11 +20,11 @@ require_once "inc_all_settings.php";
                     <select class="form-control select2" name="start_page" data-tags="true" required>
                         <?php if (!in_array($config_start_page, array_keys($start_page_select_array))) { ?>
                             <option selected> <?php echo nullable_htmlentities($config_start_page); ?></option>
                         <?php } ?>
                         <?php foreach ($start_page_select_array as $start_page_value => $start_page_name) { ?>
-                            <option <?php if ($start_page_value == $config_start_page) { echo "selected"; } ?> 
+                            <option <?php if ($start_page_value == $config_start_page) { echo "selected"; } ?>
                                 value="<?php echo nullable_htmlentities($start_page_value); ?>">
                                 <?php echo nullable_htmlentities($start_page_name); ?>
                             </option>
                         <?php }?>
                     </select>
diff --git a/settings_integrations.php b/settings_integrations.php
index 11a0cf33..0fe51862 100644
--- a/settings_integrations.php
+++ b/settings_integrations.php
@@ -6,10 +6,11 @@ require_once "inc_all_settings.php";
         <div class="card-header py-3">
             <h3 class="card-title"><i class="fas fa-fw fa-plug mr-2"></i>Integration Settings</h3>
         </div>
         <div class="card-body">
             <form action="post.php" method="post" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
                 <h4>Client Portal SSO via Microsoft Azure AD</h4>
                 <div class="form-group">
                     <label>MS Azure OAuth App (Client) ID</label>
                     <div class="input-group">
diff --git a/settings_invoice.php b/settings_invoice.php
index 3cf01da4..230b6be1 100644
--- a/settings_invoice.php
+++ b/settings_invoice.php
@@ -6,10 +6,11 @@ require_once "inc_all_settings.php";
         <div class="card-header py-3">
             <h3 class="card-title"><i class="fas fa-fw fa-file-invoice mr-2"></i>Invoice Settings</h3>
         </div>
         <div class="card-body">
             <form action="post.php" method="post" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
                 <h4>Invoice</h4>
 
                 <div class="form-group">
                     <label>Invoice Prefix</label>
diff --git a/settings_localization.php b/settings_localization.php
index fb0db45a..d7cf4b59 100644
--- a/settings_localization.php
+++ b/settings_localization.php
@@ -17,10 +17,11 @@ $timezones = DateTimeZone::listIdentifiers();
         <div class="card-header py-3">
             <h3 class="card-title"><i class="fas fa-fw fa-globe mr-2"></i>Localization</h3>
         </div>
         <div class="card-body">
             <form action="post.php" method="post" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
                 <div class="form-group">
                     <label>Language <strong class="text-danger">*</strong></label>
                     <div class="input-group">
                         <div class="input-group-prepend">
diff --git a/settings_mail.php b/settings_mail.php
index a6a4a9bb..6a55793b 100644
--- a/settings_mail.php
+++ b/settings_mail.php
@@ -6,10 +6,11 @@ require_once "inc_all_settings.php";
         <div class="card-header py-3">
             <h3 class="card-title"><i class="fas fa-fw fa-envelope mr-2"></i>SMTP Mail Settings <small>(For Sending Email)</small></h3>
         </div>
         <div class="card-body">
             <form action="post.php" method="post" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
                 <div class="form-group">
                     <label>SMTP Host</label>
                     <div class="input-group">
                         <div class="input-group-prepend">
@@ -78,10 +79,11 @@ require_once "inc_all_settings.php";
         <div class="card-header py-3">
             <h3 class="card-title"><i class="fas fa-fw fa-envelope mr-2"></i>IMAP Mail Settings <small>(For Monitoring Ticket Inbox)</small></h3>
         </div>
         <div class="card-body">
             <form action="post.php" method="post" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
                 <div class="form-group">
                     <label>IMAP Host</label>
                     <div class="input-group">
                         <div class="input-group-prepend">
@@ -152,10 +154,12 @@ require_once "inc_all_settings.php";
         <div class="card-header py-3">
             <h3 class="card-title"><i class="fas fa-fw fa-paper-plane mr-2"></i>Mail From Configuration</h3>
         </div>
         <div class="card-body">
             <form action="post.php" method="post" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
+
                 <p>Each of the "From Email" Addresses need to be able to send email on behalf of the SMTP user configured above
                 <h5>System Default</h5>
                 <p class="text-secondary">(used for system tasks such as sending share links)</p>
                 <div class="form-group">
                     <label>From Email</label>
@@ -260,10 +264,12 @@ require_once "inc_all_settings.php";
         <div class="card-header py-3">
             <h3 class="card-title"><i class="fas fa-fw fa-paper-plane mr-2"></i>Test Email Sending</h3>
         </div>
         <div class="card-body">
             <form action="post.php" method="post" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
+
                 <div class="input-group">
                     <select class="form-control select2" name="email_from" required>
                         <option value="">- Select an Email Address to send from -</option>
                         <?php
                         if(!empty($config_mail_from_email)){
@@ -306,10 +312,12 @@ require_once "inc_all_settings.php";
         <div class="card-header py-3">
             <h3 class="card-title"><i class="fas fa-fw fa-plug mr-2"></i>Test IMAP Connection</h3>
         </div>
         <div class="card-body">
             <form action="post.php" method="post" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
+
                 <div class="input-group-append">
                     <button type="submit" name="test_email_imap" class="btn btn-success"><i class="fas fa-fw fa-inbox mr-2"></i>Test</button>
                 </div>
             </form>
         </div>
diff --git a/settings_modules.php b/settings_modules.php
index 30f7f210..6b190c51 100644
--- a/settings_modules.php
+++ b/settings_modules.php
@@ -6,10 +6,11 @@ require_once "inc_all_settings.php";
         <div class="card-header py-3">
             <h3 class="card-title"><i class="fas fa-fw fa-cube mr-2"></i>Modules</h3>
         </div>
         <div class="card-body">
             <form action="post.php" method="post" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
                 <div class="form-group">
                     <div class="custom-control custom-switch">
                         <input type="checkbox" class="custom-control-input" name="config_module_enable_itdoc" <?php if ($config_module_enable_itdoc == 1) { echo "checked"; } ?> value="1" id="customSwitch1">
                         <label class="custom-control-label" for="customSwitch1">Show IT Documentation</label>
diff --git a/settings_quote.php b/settings_quote.php
index a7abac11..2a51e301 100644
--- a/settings_quote.php
+++ b/settings_quote.php
@@ -6,10 +6,11 @@ require_once "inc_all_settings.php";
         <div class="card-header py-3">
             <h3 class="card-title"><i class="fas fa-fw fa-comment-dollar mr-2"></i>Quote Settings</h3>
         </div>
         <div class="card-body">
             <form action="post.php" method="post" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
                 <div class="form-group">
                     <label>Quote Prefix</label>
                     <div class="input-group">
                         <div class="input-group-prepend">
diff --git a/settings_security.php b/settings_security.php
index 64bf009c..9b452b85 100644
--- a/settings_security.php
+++ b/settings_security.php
@@ -7,10 +7,11 @@ require_once "inc_all_settings.php";
         <div class="card-header py-3">
             <h3 class="card-title"><i class="fas fa-fw fa-shield-alt mr-2"></i>Security</h3>
         </div>
         <div class="card-body">
             <form action="post.php" method="post" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
                 <div class="form-group">
                     <label>Login Message</label>
                     <textarea class="form-control" name="config_login_message" rows="5" placeholder="Enter a message to be displayed on the login screen"><?php echo nullable_htmlentities($config_login_message); ?></textarea>
                 </div>
diff --git a/settings_tax_add_modal.php b/settings_tax_add_modal.php
index 74526414..59cfadb7 100644
--- a/settings_tax_add_modal.php
+++ b/settings_tax_add_modal.php
@@ -6,10 +6,12 @@
         <button type="button" class="close text-white" data-dismiss="modal">
           <span aria-hidden="true">&times;</span>
         </button>
       </div>
       <form action="post.php" method="post" autocomplete="off">
+        <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
+
         <div class="modal-body bg-white">
           <div class="form-group">
             <label>Name <strong class="text-danger">*</strong></label>
             <input type="text" class="form-control" name="name" placeholder="Tax name" required autofocus>
           </div>
@@ -23,6 +25,6 @@
           <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
         </div>
       </form>
     </div>
   </div>
-</div>
\ No newline at end of file
+</div>
diff --git a/settings_tax_edit_modal.php b/settings_tax_edit_modal.php
index 077aa4d4..89e625e4 100644
--- a/settings_tax_edit_modal.php
+++ b/settings_tax_edit_modal.php
@@ -6,28 +6,30 @@
         <button type="button" class="close text-white" data-dismiss="modal">
           <span>&times;</span>
         </button>
       </div>
       <form action="post.php" method="post" autocomplete="off">
+        <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
         <input type="hidden" name="tax_id" value="<?php echo $tax_id; ?>">
+
         <div class="modal-body bg-white">
-          
+
           <div class="form-group">
             <label>Name <strong class="text-danger">*</strong></label>
             <input type="text" class="form-control" name="name" value="<?php echo $tax_name; ?>" required>
           </div>
-          
+
           <div class="form-group">
             <label>Percent <strong class="text-danger">*</strong></label>
             <input type="number" min="0" step="any" class="form-control col-md-4" name="percent" value="<?php echo $tax_percent; ?>">
-          
+
           </div>
-        
+
         </div>
         <div class="modal-footer bg-white">
           <button type="submit" name="edit_tax" class="btn btn-primary text-bold"><i class="fas fa-check mr-2"></i>Save</button>
           <button type="button" class="btn btn-light" data-dismiss="modal"><i class="fas fa-times mr-2"></i>Cancel</button>
         </div>
       </form>
     </div>
   </div>
-</div>
\ No newline at end of file
+</div>
diff --git a/settings_taxes.php b/settings_taxes.php
index 92dcde48..c686362e 100644
--- a/settings_taxes.php
+++ b/settings_taxes.php
@@ -9,11 +9,11 @@ require_once "inc_all_settings.php";
 
 //Rebuild URL
 $url_query_strings_sort = http_build_query($get_copy);
 
 $sql = mysqli_query(
-    $mysqli, 
+    $mysqli,
     "SELECT * FROM taxes
     WHERE tax_archived_at IS NULL
     ORDER BY $sort $order"
 );
 
@@ -58,11 +58,11 @@ $num_rows = mysqli_num_rows($sql);
                                     <div class="dropdown-menu">
                                         <a class="dropdown-item" href="#" data-toggle="modal" data-target="#editTaxModal<?php echo $tax_id; ?>">
                                             <i class="fas fa-fw fa-edit mr-2"></i>Edit
                                         </a>
                                         <div class="dropdown-divider"></div>
-                                        <a class="dropdown-item text-danger confirm-link" href="post.php?archive_tax=<?php echo $tax_id; ?>">
+                                        <a class="dropdown-item text-danger confirm-link" href="post.php?archive_tax=<?php echo $tax_id; ?>&csrf_token=<?php echo $_SESSION['csrf_token'] ?>">
                                             <i class="fas fa-fw fa-archive mr-2"></i>Archive
                                         </a>
                                     </div>
                                 </div>
                             </td>
diff --git a/settings_telemetry.php b/settings_telemetry.php
index ec368a56..8c50f216 100644
--- a/settings_telemetry.php
+++ b/settings_telemetry.php
@@ -9,10 +9,11 @@ require_once "inc_all_settings.php";
         <div class="card-body">
 
             <p class="text-center">Installation ID: <strong><?php echo $installation_id; ?></strong></p>
 
             <form action="post.php" method="post" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
                 <div class="form-group">
                     <label>Telemetry</label>
                     <p><i>If you can't measure it, you can't improve it. Please consider turning on telemetry data to provide valuable insights on how you're using ITFlow - so we can improve it for everyone. </i></p>
                     <div class="input-group">
diff --git a/settings_theme.php b/settings_theme.php
index 4f4e528b..7150c0b7 100644
--- a/settings_theme.php
+++ b/settings_theme.php
@@ -6,10 +6,11 @@ require_once "inc_all_settings.php";
         <div class="card-header py-3">
             <h3 class="card-title"><i class="fas fa-fw fa-paint-brush mr-2"></i>Theme</h3>
         </div>
         <div class="card-body">
             <form action="post.php" method="post" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
                 <label>Select a Theme</label>
                 <div class="form-row">
 
                     <?php
diff --git a/settings_ticket.php b/settings_ticket.php
index 39d81221..20ba5101 100644
--- a/settings_ticket.php
+++ b/settings_ticket.php
@@ -6,10 +6,11 @@ require_once "inc_all_settings.php";
         <div class="card-header py-3">
             <h3 class="card-title"><i class="fas fa-fw fa-life-ring mr-2"></i>Ticket Settings</h3>
         </div>
         <div class="card-body">
             <form action="post.php" method="post" autocomplete="off">
+                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
 
                 <div class="form-group">
                     <label>Ticket Prefix</label>
                     <div class="input-group">
                         <div class="input-group-prepend">

Vulnerable code:             <a class="btn btn-primary btn-lg p-3" href="post.php?download_database"><i class="fas fa-fw fa-4x fa-download"></i><br><br>Download</a>
                            <option <?php if ($start_page_value == $config_start_page) { echo "selected"; } ?> 
</div>
          
          
          
        
</div>
    $mysqli, 
                                        <a class="dropdown-item text-danger confirm-link" href="post.php?archive_tax=<?php echo $tax_id; ?>">
Fixed code:     validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);

    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_GET['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_POST['csrf_token']);
    validateCSRFToken($_GET['csrf_token']);
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
            <a class="btn btn-primary btn-lg p-3" href="post.php?download_database&csrf_token=<?php echo $_SESSION['csrf_token'] ?>"><i class="fas fa-fw fa-4x fa-download"></i><br><br>Download</a>
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
            <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                            <option <?php if ($start_page_value == $config_start_page) { echo "selected"; } ?>
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
        <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">

</div>
        <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">





</div>
    $mysqli,
                                        <a class="dropdown-item text-danger confirm-link" href="post.php?archive_tax=<?php echo $tax_id; ?>&csrf_token=<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">
                <input type="hidden" name="csrf_token" value="<?php echo $_SESSION['csrf_token'] ?>">